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ABSTRACT 

The  International  Civil  Aviation  Organization  (ICAO) 
defines  Category  II  Operational  Performance  as,  “Opera¬ 
tion  down  to  minima  below  60  metres  (200  feet)  and 
800  metres  (2600  feet)  visibility  and  to  as  low  as  30 
metres  (100  feet)  and  400  metres  (1300  feet)  visibility 
with  a  high  probability  of  approach  success.” 

It  is  the  purpose  of  this  paper  to  define  an  airlwme 
system  for  turbojet  aircraft  which  will  provide  this 
capability.  Emphasis  will  be  placed  on  the  selection 
of  equipment  and  total  system  concept  rather  than  on 
details  of  how  the  equipment  operates.  The  selection 
of  equipment  is  based  on  Douglas,  industry,  and  Govern¬ 
ment  experience. 

Basically  the  components  of  a  Category  II  sysU'm  are 
common  to  all  turbojet  aircraft.  Therefore',  in  this  paper 
the  recommended  equipment  for  Category  II  o|><.>ration 
with  the  Douglas  DC-9  aircraft  will  be  used  us  an 
example  of  a  Category  II  system  for  turlxijet  aircraft. 
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INTRODUCTION 

The  Douglas  Aircraft  Company  believes  that  the  basic 
components  of  an  all-weather  approach  and  landing 
system  exist,  and  careful  selection  and  integration  of 
these  components  will  yield  a  safe  and  reliable  system 
at  minimum  cost.  This  approach,  confirmed  by  eiqieri- 
ence  gained  during  all-weather  programs  on  the  DC-8,  is 
reflected  in  the  DC-9  aircraft. 

The  basic  design  of  the  DC-9  and  its  systems  will  aid 
the  operators  in  obtaining  FAA  approval  to  operate  in 
weather  minimums  of  200  foot  ceiling  and  2600  foot 
visibility  (ICAO  Category  I  Operational  Performance). 
Achieving  ICAO  Category  II  Operational  Performance, 

100  foot  ceiling  and  1300  foot  visibility,  is  made  pos¬ 
sible  through  the  introduction  of  add-on  equipment 
which  the  basic  aircraft  and  its  systems  are  designed 
to  accept. 

The  equipment  required  to  operate  to  Category  II  weather 
minimums  is  predicated  on  the  concept  that,  while  decid¬ 
ing  whether  to  land  or  initiate  a  go-around  maneuver  at 
the  100-foot  commitment  altitude,  the  pilot  must  be  able 
to  unhurriedly  assess  the  approach  situation  and  sUty 
*on  top”  of  the  aircraft.  When  the  aircraft  arrives  at 
this  commitment  altitude,  it  should  be  accurately  aligned 
with  the  localizer  and  glide  path  beam  centers,  have 
the  proper  airspeed,  and  be  stabilized  so  that  the  pilot 
can  safely  land  the  aircraft  if  he  can  see  the  runway 
from  the  lOO-foot  altitude  or  execute  a  go-around  if  the 
runway  is  not  visible. 
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SYSTEM  DESCRIPTION 


Figure  1  illustrates  the  Category  II  low-approach  sys¬ 
tem  recommended  for  the  Douglas  DC-9  aircraft.  The 
electronic  components  of  the  system  are: 

•  Automatic  pilot 

•  Automatic  pilot  monitor 

•  Flight  director  computer 

•  Flight  instruments 

•  Instnimoit  monito* 

•  Navigation  receiver 

•  Vertical  gyro 

•  Compass  system 

•  Radar  altimeter 

•  Vertical  speed  sensor 

•  Go-around  computer 

•  Automatic  throttle 

The  blocks  in  Figure  1  defined  as  “Air  Data  Computer* 
and  “Stabilization”  are  components  of  the  basic  auto¬ 
matic  pilot  system.  All  of  the  equipment  in  the  Category 
II  system  is  dual  with  the  exception  of  the  automatic 
pilot  and  the  automatic  throttle  control. 


It  can  be  seen  from  Figure  1  that  there  are  throe  control 
paths  (pilot,  copilot,  and  automatic  pilot)  which  may  be 
used  independently  for  control  of  the  aircraft  during  the 
approach.  Except  that  the  three  systems  share  some 
common  components,  triple  redundancy  is  realized.  How 
effective  this  degree  of  triple  redundancy  is  depends 
upon: 

•  Reliability  of  the  common  components 

•  Prompt  recognition  of  a  failure  or  problem 

•  The  pilots’  ability  to  adequately  fulfill  their  role  in 
the  control  loop 

The  concept  illustrated  in  Figure  1  eliminates  the  need 
for  redundant  automatic  pilot  and/or  flight  director 
systems  and  is  compatible  with  the  FAA  philosophy  pre¬ 
sented  in  RFP  30R-3-l,359  (All  Weather  Landing  System 
For  Turbojet  Aircraft).  This  FAA  program  will  determine, 
among  other  things,  the  effectiveness  of  the  manual  in¬ 
strument  system  in  performing  approaches  and  landings 
to  the  point  of  touchdown. 

A  “building  block*  principle  is  used  to  develop  a  safe 
and  reliable  Category  II  system  at  minimum  cost  for  the 
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DC-9  aircraft.  The  basic  DC-9  approach  system  provides 
Category  1  operation  and  the  introduction  of  “add-«i* 
equipment  will  provide  Category  II  operation.  This  de¬ 
velopment  sequence,  which  ultimately  will  yield  a  safe 
and  reliable  all-weather  landing  system,  is  based  on  the 
following: 

•  Elements  added  in  each  phase  must  not  obsolete  pre¬ 
viously  installed  equipment. 

•  Existing  fully  developed  airborne  equipment  is  utilized 
where  possible  to  reduce  development  costs  and  assure 
high  reliability. 

•  The  use  of  exotic  equipment,  either  airborne  or  ground- 
based,  is  avoided. 

•  To  aid  in  the  reduction  of  equipment  costs,  maximum 
use  is  made  of  the  pilot  in  monitoring  the  system  and 
executing  recommended  procedures. 

•  The  system  enables  the  pilot  and  copilot  to  efficient¬ 
ly  perform  their  tasks;  thus,  during  the  approach,  the 
pilot  can  make  prompt  but  unhurried  decisions  before 
any  critical  decision  point  is  reached. 


The  basic  DC-9  approach  system,  shown  in  Figure  2, 
provides  the  ceq>ability  for  ICAO  Category  I  Operational 
Performance.  The  automatic  pilot  control  coupled  >vith 
an  improved  flight  director  and  instrumoit  display,  im¬ 
proves  the  pilot’s  ability  to  monitor  the  api»oach,  make 
decisions,  and  take  over  control  of  the  aircraft  at  the 
breakout  altitude.  In  addition,  the  improved  flight  direc¬ 
tor  and  display  make  it  possible  to  perform  accurate  man¬ 
ual  instrument  approaches  to  low  altitudes. 

The  minimum  add-on  equipment  required  to  extend  the 
approach  capability  of  the  DC-9  aircraft  from  Category 
I  to  Category  II  is  shown  in  Figure  3.  To  further  refine 
system  performance,  two  additional  items  of  equipment 
are  recommended  in  addition  to  the  minimum  add-on  equip¬ 
ment.  This  equipment,  a  second  radar  altimeter  and  an 
automatic  throttle  control,  is  circled  in  Figure  3. 

Automatic  Pilot 

All  of  the  essentials  for  providing  automatic  low-approach 
capabilities  arc  embodied  in  the  automatic  pilot  to  be 
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used  on  the  D04  aircraft.  Those  features  pertinent  to 
the  low  approach  (Category  ID  are: 

•  Variable  localizer  intercept  angle  (0  to  90  degrees) 
e  Automatic  ILS  operation 

•  ILS  gain  programming 

•  Middle  marker  sensing 

•  Glide  path  extension 

•  Failure  monitor 

Automatic  ILS  operation  and  the  variable  localizer  inter¬ 
cept  angle  relieve  the  pilot  of  unnecessary  action  during 
an  automatic  approach.  This  allows  him  to  focus  his  at¬ 
tention  on  assessment  of  the  automatic  pilot  operation. 


and  glide  path  beam  causes  the  radio  guidance  gains  to 
assume  a  higher  than  normal  value.  To  compensate  for 
the  beam  geometry,  ILS  gain-programming  circuitry  is 
provided  in  the  DC-9  automatic  pilot  to  linearly  decrease 
the  localizer  and  glide  path  control  gains  after  intercep¬ 
tion  of  the  glide  path. 

Another  problem  associated  with  the  ILS  beam,  glide- 
path-beam  distortion  at  low  altitudes,  has  made  necessary 
a  requirement  for  some  means  of  removing  unflyaUe  glide- 
path-beam  information  from  a  low  approach  system  while 
maintaining  the  glide  path  angle  to  the  flare  initiation 
altitude.  This  requirement  has  been  complied  with  in  the 
DC-9  automatic  pilot.  When  the  aircraft  flies  over  the  mid¬ 
dle  marker  beacon,  a  glide-path-extension  mode  based  on 
memorized  vertical  speed  is  automatically  initiated.  In 
addition,  a  second  stage  of  glide  path  gain  piopamming 
is  activated  which  linearly  programs  the  glide  path  dis- 


To  achieve  positive  capture  and  accurate  control  on  the 
ILS  localizer  and  glide  path  beams  during  the  uiitial 
phases  an  automatic  approach,  high  gains  are  neces¬ 
sary  in  the  automatirypilot  radio-guidance  circuitry.  As 
the  aircraft  nears  the  approach  end  of  the  runway  these 
high  gains  are  detrimental  to  stable  automatic  pilot  con¬ 
trol,  since  the  convergent  characteristic  of  the  localizer 


placement  gain  from  a  low  value  to  zero.  By  slowly  fading 
out  the  remaining  glide  path  beam  information,  a  flight 
path  reference  is  provided  for  an  extended  period  without 
incurring  a  stability  problem.  If  a  middle  marker  beacon 
is  not  available  at  the  airport,  or  is  inoperative,  the  pilot 
can  manually  initiate  the  glide  path  extension  mode  at 
his  discretion. 
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Automatic  Pilot  Monitor 

To  reduce  pilot  concern  about  automatic  pilot  malAinc- 
tions  during  the  approach  and  assure  safe  operation  at 
low  altitudes,  an  automatic  pilot  failure  monitn  is  in¬ 
cluded  in  the  Category  II  system.  This  monitor  detects 
active  failures  in  the  automatic  pilot  and  automatically 
disconnects  the  servo  system  before  any  significant  con¬ 
trol  surface  deflection  results.  It  is  a  fail-safe  device, 
since  failures  in  the  monitor  will  also  cause  the  auto¬ 
matic  pilot  to  be  disengaged.  In  addition,  the  contacts 
of  the  monitor  relay  are  connected  into  the  automatic- 
piloi-engage  interlock  circuitry  so  that  the  automatic 
pilot  cannot  be  engaged  if  the  monitor  relay  contacts 
fail  in  the  open  or  closed  position. 

Flight  Director  System 

The  flight  director  system  in  the  DC-9  aircraft  provides 
a  means  for  pilot  assessment  of  the  automatic  approach, 
thereby  allowmg  him  to  easily  assume  manual  control  of 
the  aircraft  if  the  automatic  system  malfut  .ons.  It  also 
provides  the  pilot  with  a  means  to  perform  an  accurate 
manual  instrument  approach  if  he  desires. 

Compatibility  with  the  automatic  pilot  is  emphasized  in 
a  flight  director  system  for  low  approach  aircraft  opera¬ 
tion.  The  flight  director  system  in  the  DC-9  aircraft 
achieves  this  through  implementation  of  the  following  * 
features: 

•  Variable  localizer  intercept  angle  (0  to  90  degrees) 

•  Automatic  ILS  operation 

•  Middle  marker  sensor 

•  ILS  gain  programming 

•  Glide  path  extension  utilizing  vertical  speed 

emphasis  has  also  been  given  to  providing  a  natural, 
unambiguous  display  of  information  to  the  pilot  on  the 
attitude  director  indicator  al  the  DC-9  to  simplify  int«- 
pretation  and  reduce  “instrument  searching.”  A  three- 
dimensional  design  of  the  fixed  aircraft  symbol  and  the 
command  bar  displays  the  spatial  situation  of  the  air¬ 
craft  during  the  ^iproach  arid  improves  accuracy  by 
reducing  the  parallax  problem  normally  associated  with 
pointer-type  displays.  ILS  beam  displacement  informa¬ 
tion  is  provided  by  presenting  glide  slope  deviation  on 
the  left  side  of  the  attitude  director  indicator  and 
localizer  deviation  (in  the  form  of  a  runway  symbol)  in 
the  lower  section  of  the  indicator. 

Instrument  Monitor 

An  instrument  monitor  is  added  to  the  flight  director 
system  to  monitor  the  critical  navigation  equipment.  The 
monitor  activates  the  pilot’s  and  copilot’s  master  warn¬ 


ing  lights  on  the  glareshield  and  illuminates  an  equip- 
nnent  light  on  an  aimunciator  panel.  This  informs  the  crew 
of  any  discrepancy  in  the  navigation  equipment  so  that 
they  can  readily  take  appropriate  action.  The  inputs  to 
the  monitor  system  include: 

s  Compass  system 

•  Pitch  attitude 
s  Bank  attitude 

•  Localizer  receiver  output  - 

•  Glide  path  receiver  output 

The  localizer  and  glide  path  receivers  were  chosen  as 
subsystems  for  the  monitor  system  because  a  failure  of 
either  one  represents  a  loss  of  reference  to  the  desired 
approach  flight  path.  Pitch  attitude,  bank  attitude,  and 
the  compass  system  were  selected  because  they  are  the 
basic  references,  providing  stabilization  about  the  three 
aircraft-control  axes,  for  the  pilot,  instruments,  and  autO' 
matic  systems. 

The  random  location  of  malfunction  warning  and  caution 
lights,  which  is  detrimental  to  safe  Category  II  opera¬ 
tion,  is  eliminated  by  a  master  light  and  annunciator 
panel  system  in  the  1X^-9  aircraft.  Master  caution  and 
warning  lights  are  located  in  the  glareshielJ  directly 
in  front  of  both  flight  stations  to  ensure  that  they  will 
be  noticed  immediately  upon  actuation.  All  annunciators 
are  located  in  the  forward  end  of  the  overhead  panel. 

When  a  malfunction  sensor  is  energized,  the  master 
lights  at  each  flight  station  and  the  appropriate  annunci¬ 
ator  legend  are  illuminated.  The  pilot  or  copilot  can  scan 
the  annunciator  panel  in  a  quick  glance. 

Go-Around  Computer 

The  go-around  maneuver  becomes  extremely  important 
when  operating  down  to  100-foot  ceiling  conditions.  To 
ensure  safety  at  low  altitudes,  a  go-around  computer  is 
added  to  the  Category  II  approach  system.  The  go-around 
computer  utilizes  angle  of  idtack  and  horizontal  acceler¬ 
ation  information  to  compute  a  safe  arul  optimum  g(^ 
around  vertical  steering  command  for  the  pilot’s  display. 
The  pilot  controls  the  aircraft  pitch  axis  to  ke^  the 
command  bar  of  the  attitude  director  indicator  centered 
while  thrust  is  applied  and  the  aircraft  is  ‘cleaned  up.* 
This  results  in  a  minimum  loss  of  altitude  and  in  proper 
speed  scheduling  for  optimum  climb-out  performance  in 
the  go-around  maneuver. 

The  rnigle  of  attack  transducer  and  horizontal  acceler¬ 
ometer  used  for  the  go-around  computation  can  also  be 
used  to  compute  an  airspeed  reference  sipial  for  display 
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1;  to  the  pilot  during  an  approach.  By  moving  the  throttles 

to  satiaiy  the  speed  control  indicator  demands,  the  pilot 
can  hold  the  airspeed  necessary  to  maintain  a  given 
stall  speed  ratio  for  any  aircraft  weight,  flap  configu¬ 
ration,  or  g^aneuver.  This  speed  control  system  can 
act  as  a  monitor  of  automatic  throttle  control  and  pro¬ 
vide  a  manual  back-up  for  pilot  control  if  the  automatic 
throttle  system  malfunctions. 

Radar  Altimeter 

i' 

^  A  radar  altimeter  installation  is  provided  in  the  Category 

I  II  approach  system  to  obtain  precise  altitude  infoima- 

f  tion  above  the  runway  so  the  pilot  can  accurately  deter¬ 

mine  when  the  aircraft  arrives  at  the  100-foot  commitment 
altitude.  This  is  essential  to  the  pilot  in  his  decision 
to  land  the  aircraft  or  Initiate  a  go-atound  maneuver. 
Barometric  altimeters  are  not  considered  satisfactory 
for  use  at  low  altitudes  because  of  lags  in  the  system 
and  the  possibility  of  an  inaccurate  altimeter  setting. 


Unlike  the  other  equipment  in  the  Category  II  tow 
approach  system,  which  can  be  assessed  in  other  phases 
of  the  flight  envelope,  the  radar  altimeter  is  not  opera¬ 
tional  until  shortly  prior  to  its  use  in  the  critical  period 
I  of  the  approach.  Pew  this  reason,  a  self-test  unit  pro- 

I  vides  an  in-flight  check  for  pilot  confidence. 

I 

I,  Because  height  above  the  runway  information  is  so 

\ ;  critical  for  both  the  approach  and  go-around,  a  dual 

|i  radar  altimeter  installation  is  recommended  for  a 
I  Category  II  low  approach  system. 

f 

t  .  Automatic  Throttle 

The  Category  II  system  described  thus  far  is  in  general 
•  agreement  with  the  thinking  of  all  those  concerned  with 

f  all-weather  operations.  A  possible  exception  may  be 

the  use  of  the  dual  radar  altimeter  installation.  A 
i  )  second  nebulous  area  is  the  use  of  automatic  throttle. 


Normally,  aircraft  speed  control  is  accomplished  by  a 
proper  blending  of  engine  power,  flap  position,  and  pitch 
attitude  by  the  pilot.  Although  adequate  airspeed  con¬ 
trol  can  be  accomidished  in  this  manner,  rigid  cockpit 
procedures  may  increase  the  pilot  workload  and  place 
him  under  pressure  during  an  approach  in  adverse 
weather  conditions.  In  addition,  a  manual  or  automatic 
apiMoach  can  be  degraded  by  too  much  throttle  action 
and  the  aircraft  may  not  be  completely  stabilized  when 
the  low  approach  minimum  is  reached.  The  addition  of 
automatic  throttle  control  is  recommended  fex  the  Cate¬ 
gory  n  low  approach  system  to  substantially  improve 
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the  completed-approach/missed-appruach  ratio,  thereby 
reducing  the  number  of  go-arounds.  Automatic  throttle 
control  is  especially  beneficial  when  the  pilot  performs 
a  manual  instrument  approach;  he  is  relieved  of  the 
responsibility  of  manually  controlling  throttles  to  main¬ 
tain  airspeed  and  can  devote  his  full  attention  to  the 
attitude  director  indicator. 

The  airspeed  reference  signal  computed  fiom  angle  of 
attack  and  horizontal  acceleration  in  the  go-around 
computer  can  be  used  in  th^  automatic  throttle  system. 
(It  will  be  recalled  that  this  signal  is  displayed  on  a 
speed  control  indicator  for  use  by  the  pilot  during 
manual  control  of  airspeed  ip  the  approach.)  Deviations 
from  the  computed  airspeed  reference  are  directed  to 
a  servo  amplifier  and  servo  drive  which  automatically 
positions  the  throttles  to  maintain  airspeed. 

In  the  D&-9  aircraft,  the  throttle  s^o  drive  is  coupled 
to  the  throttle  linkages  ti'.rough  individual  magnetic 
clutches  (one  for  each  engine)  which  must  be  energized 
for  automatic  throttle  operation.  Friction  slip  clutches 
are  incorporated  to  enable  the  pilot  to  individually 
position  each  throttle  lever  without  disengaging  the 
system,  and  to  provide  a  manual  override  capability. 

Sensors 

The  remaining  electronic  components  of  the  Category 
II  system  consist  of  the  navigation  receivers,  vertical 
gyros,  and  the  compass  systems.  These  components 
perform  their  normal  function  of  providing  flight  path 
and  attitude  references. 

Electrical  System 

An  additional  feature  of  the  D09  Category  11  system 
aids  in  satisfying  the  requirement  that  no  single  failure 
shall  disable  both  the  automatic  system  and  the  pilot’s 
instrument  system.  This  is  accomplished  not  only  by 
functionally  isolating  the  systems  but  also  by  isolating 
their  sources  of  power.  The  automatic  pilot  and  the 
copilot’s  instruments  and  flight  director  system  are 
connected  to  the  same  electrical  bus;  while  the  pilot’s 
instruments  and  flight  director  system  are  connected 
to  a  separate  electrical  bus.  This  isolation  also  leads 
to  a  philosophy  of  system  management  which  is  well 
suited  to  the  needs  of  all-weather  approach  and  landing. 
The  pilot  is  the  aircraft  commander  with  the  responsi¬ 
bility  of  monitoring  aircraft  performance  and  success¬ 
fully  completing  the  approach  and  landing.  The  co¬ 
pilot’s  rde  is  managing  the  automatic  equipment  and 
checking  its  satisfactory  operation. 


y^ircraft 

In  addition  to  the  electronic  systems  installed  in  the 
DC-9  aircraft  for  Category  II  operation,  the  aircraft 
itself  plays  an  important  role  in  achieving  all-weather 
operation.  Aircraft  handling  characteristics,  stability, 
performance,  and  control  must  be  considered  to  ensure 
safe  operation  with  a  Category  II  system. 

The  installation  and  mounting  design  of  the  twin  engines 
on  the  fuselage  of  the  DC-9  aircraft  minimizes  the 
effect  of  a  large  thrust  change  or  loss  of  an  engine  on 
the  trim  of  the  aircraft.  Careful  design  of  engine  installa¬ 
tion  positions  the  thrust  line  to  eliminate  pitching  mo¬ 
ments  caused  by  changes  in  thrust.  Mounting  the  engines 
on  the  fuselage  reduces  the  magnitude  of  the  yawing 
moment  incurred  when  an  engine  fails. 

The  DC-9  mechanical  flight  control  system  is  cable- 
controlled  and  designed  so  that  no  single  failure  can 
result  in  loss  of  control  of  the  aircraft.  The  pitch,  roll, 
and  yaw  systems  are  duplicated  from  the  cockpit  to 
the  control  surfaces  to  provide  redundant  control  paths. 
All  the  control  systems  are  designed  for  simplicity, 
maximum  reliability,  and  minimum  maintenance. 

The  flight  compartment  of  the  DC-9  aircraft  is  designed 
for  a  two-man  crew  with  all  systems  controlled  from 
either  seat.  This  allows  each  operator  greater  flexibility 
in  developing  cockpit  procedures  for  low  approach  and 
landing  operations  during  adverse  weather  conditions. 

During  an  approach  in  adverse  weather,  at  the  critical 
altitude  of  100  feet  the  pilot  must  be  able  to  make  visual 
contact  with  the  ground  or  execute  a  go-around  maneuver. 
In  order  to  provide  clear  visibility  through  the  wind¬ 
shield,  electrically  heated  glass  is  used  for  defogging 
and  anti-icing.  In  addition,  rain  removal  from  the  wind¬ 
shields  is  accomplished  by  an  electric  wiper.  Minimiza¬ 
tion  of  reflection  ftom  light  sources  both  inside  and 
outside  the  aircraft  is  provided  by  a  glareshield. 

THE  NEXT  STEP 

To  cany  the  all-weather  landing  system  capability 
bdow  the  100-foot  ceiling  minimum,  the  flight  director. 


instruments,  and  system  monitor  must  display  the  ap¬ 
proach  situation  with  a  high  degree  of  accuracy  and 
reliability,  and  in  a  form  suitable  for  rapid  assimilation 
and  correct  interpretation  by  the  pilot.  In  addition, 
highly  accurate,  stable,  and  reliable  automatic  systems 
which  the  pilot  can  utilize  with  confidence  are  required. 
These  requirements  are  met  in  the  Category  II  system 
discussed  in  this  paper.  In  addition,  the  system  is 
designed  to: 

•  Allow  maximum  use  of  system  components  prior  to 
their  use  in  the  critical  period  of  the  approach  and 
landing  so  that  the  pilot  can  continually  assess  the 
equipment  performance  throughout  the  flight  envelope. 

•  Minimize  switching  of  vital  circuitry  close  to  the 
ground  to  prevent  switching  malfunctions  at  low 
altitudes. 

•  Prevent  rapid  maneuvers  close  to  the  ground  by 
limiting  attitude  and  rate  commands. 

•  Provide  compatible  automatic  pilot  and  flight  director 
modes  and  switching  to  facilitate  monitoring. 

Therefore,  this  Category  II  system  will  not  be  obsoleted 
when  the  final  goal  of  Category  III  Operational  Perform¬ 
ance  is  realized.  On  the  contrary,  it  will  smooth  the 
road  to  all-weather  touchdowns,  since  the  only  guidance 
elements  this  Category  II  system  lacks  are  the  flare 
and  de-crab  computers.  Most  certainly  the  equipment 
used  in  a  Category  II  system  will  also  be  required  in 
a  Category  III  system.  The  point  in  question  concerns 
the  accuracy  and  reliability  required  in  the  two  systems. 
The  requirements  may  be  the  same  for  the  two  systems, 
but  more  stringent  proof  of  meeting  the  requirements 
may  be  required  for  the  Category  III  system.  With  the 
implementation  of  this  Category  II  system  in  turbojet 
aircraft,  system  accuracy  and  reliability  figures  can  be 
compiled  to  determine  what  modifications  and/or  new 
equipment,  if  any,  would  be  required  to  meet  Category 
III  airborne  equipment  requirements.  In  addition,  pilots 
will  be  given  an  opportunity  to  familiarize  themselves 
with  the  equipment  which  will  ultimately  be  used  in  an 
all-weather  landing  system.  This  will  a^w  them  to 
gain  confidence  in  the  system  components  before  they 
rely  on  the  equipment  to  land  the  aircraft. 
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The  prlne  requirement  of  any  fell-saxe  or  failure- survival  system  Is  failure 
detection.  This  paper  discusses  some  of  the  practical  techniques  used  In 
the  design,  analysis,  and  testing  of  automstlc  landing  systems  for  the 
Vickers  VC  10  and  BAG  1-11.  It  Is  argued  that  In  the  future  electronic  and 
auto-control  equlpswnt  must  be  designed  so  that  assessment  of  Its  fall- 
safety  can  be  made  with  the  same  degree  of  confidence  as  safety  analysis 
on  the  aircraft  which  carries  It. 

The  paper  assumes  that  the  reader  Is  broadly  acquainted  with  the  overall 
system  concepts  In  the  VC  10  and  BAG  1-11  which  have  been  outlined  recently 
at  the  lATA  15th  Technical  Conference. 

Introduction 


Automatic  monitoring  Is  a  design  feature  of  each  of  the  two  autopilots 
In  the  VC  10  Instsllatlon.  The  prime  object  Is  to  enable  the  detection 
of  significant  failures  In  either  of  the  automatic  control  systems.  Two 
such  monitored  autopilots  can  then  be  used  as  a  failure  survival  cosblna- 
tlon  by  providing  autosiatlc  changeover  from  one  to  the  other.  This  Is 
the  basis  of  the  automatic  all  weather  landing  system  In  the  VC  10.  It 
Is  Illustrated  In  the  block  diagram  of  fig.  1,  but  will  not  be  described 
further  In  this  paper,  which  Is  limited  to  failure  detection  principles 
and  practice. 


1.  Categories  of  Automatic  Honltorlng 

Automstlc  smnltorlng  In  the  context  In  which  It  Is  used  In  the  VC  10  Is 
In  fact  autosiatlc  failure  detection  and  the  design  techniques  Involved 
fall  Into  three  major  categories: 


Category  'A*  The  measurement  of  various  system  parameters  with 
soBie  external  test  device  (absolute  measurcmsnt) . 

Category  *B*  Comparison  of  the  device  or  system  with  a  second 
device  or  system  performing  the  sasM  or  a  similar 
task  concurrently  with  the  first  (comparison  monitoring). 


Category  'C*  Overall  measurement  of  performance  of  a  task  using 

soms  measuring  means  which  Is  suitably  Independent  of 
the  device  or  system  being  checked  (performance 
monitoring) . 


All  means  of  failure  detection  Involve  either  a  measuring  or  a  comparison 
process  and  a  failure  of  the  measuring  or  comparison  device  Is  always 
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fndetectable  from  a  failure  of  the  device  being  exealned,  unlees  e  third 
suitably  coherent  device  is  also  available  and  is  used  in  such  a  aanner 
that  similar  failures  cannot  occur  in  two  or  more  of  the  devices  at  the 
same  time.  That  is,  any  direct  or  indirect  cross>connection  required  to 
allow  the  sieasurement  or  comparison  to  take  place,  must  not  Introduce 
cross-dependence . 

The  exclusive  use  of  any  one  of  the  three  techniques  is  either  impossible 
or  undesirable  and  a  combination,  depending  on  the  particular  elesients  and 
the  circumstances  in  which  they  must  each  be  used  gives  the  most  economical 
solution. 

In  relation  to  category  'A',  for  example,  the  presence  of  an  electrical 
voltage  or  hydraulic  pressure  can  be  detected  and  nmasured  with  simple 
autooiatic  Instruments.  Siaillarly  by  absolute  aieasureiaent  one  can  check 
signal  line  and  power  circuit  continuity,  load  and  source  Impedances, 
radio  carrier  transmission  levels,  aiodulation  depths,  relative  gain  and 
phase,  etc.  However,  a  complete  failure  detection  system  based  on  such 
principles  if  possible  would  be  very  complex  indeed  (fig.  2  (a)  )  and  it 
would  be  extremely  difficult  to  prove  that  there  were  no  failures  which 
could  go  undetected,  especially  between  the  amasuring  points.  Parhaps 
the  greatest  difficulty  however,  is  making  ai^  sort  of  assessable 
measurement  when  the  system  is  in  a  dynamic  state.  For  example,  the 
computation  of  an  exponential  flare-out  demand  from  radio  altlsMter 
signals  would  be  impossible  to  check  by  direct  sieasurement  as  it  occurs, 
and  the  direct  assessnmnt  of  independent  flare  path  or  rate  of  descent 
swasuresients  is  also  too  difficult  in  this  critical  sianoeuvre.  It  is 
possible  in  certain  cases  to  inject  an  excitation  signal  into  part  of 
a  system,  assess  its  effect,  and  then  cancel  it  before  it  appears  as 
an  output  (fig*  2  (b)  ).  This  technique  of  absolute  response  monitoring 
has  been  Investigated  for  "on-line"  checking  of  simple  yaw  dasqiers  but 
usually  it  is  wore  economical  and  certainly  more  complete  to  use  the 
"comparison  monitoring". 

This  is  covered  by  Cstegory  'B'.  By  comparing  the  computer  demands  with 
the  output  of  a  similar  perhaps  identical  independent  computer  it  is 
possible  to  assess  whether  the  demand  computation  is  within  the  pre¬ 
determined  acceptable  threshold.  Fig.  3  shows  block  diagrams  of  simple 
systems  employing  such  principles  from  the  sensor  slements  (separate  or 
BKmitored)  through  to  the  actuator  outputs.  A  vital  advantage  of  this 
technique  is  the  simplification  of  the  analysis  necessary  to  prove  that 
the  failure  detection  means  is  valid  for  all  significant  failures,  because 
provided  there  is  no  common  failure  probability,  most  of  the  desi^  details 
are  now  immaterial  to  this,  and  affect  only  performance  standards.  In 
fact  it  is  only  aspects  of  this  type,  such  as  the  comparator  and  discon¬ 
nect  device  itself,  which  must  be  subjected  to  detailed  investigation.  It 
should  be  clear  however  that  a  complete  failure  detection  system  based  on 
this  concept  (equivalent  to  "duplex"  or  "double-redundant")  would  be  very 
uneconomical  as  certain  aspects  can  certainly  be  siaiplified  by  other 
failure  detection  means. 
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Finally,  Category  'C'  covera  modea  of  operation  of  both  single  devices  and 
full  systems  which  lend  themselves  to  overall  performance  checking.  For 
example,  a  siiqple  case  is  that  of  a  feedback  servomechanism  which  if  oper¬ 
ating  correctly  will  not  develop  an  input-output  error  demand  greater  than 
a  certain  value  In  a  given  tlv>e,  this  being  a  function  of  the  type  of  in¬ 
put  which  It  receives.  This  value  can  be  constantly  checked  and  this 
constitutes  a  failure  detection  means.  (This  is  In  fact  the  loanner  in 
which  the  output  servos  are  monitored  In  the  systems  of  fig.  3.)  On  a 
broader  scale  this  principle  can  be  applied  to  autopilot  "hold"  facilities, 
say  for  example,  a  height  lock  where  a  deviation  from  the  height  originally 
selected  by  more  than  some  predetermined  amount  measured  on  an  Independent 
sensor,  can  be  taken  as  a  failure  (fig.  4).  In  this  example  It  Is  Impor¬ 
tant  that  the  failure  detection  circuit  Is  Independent  and  various  additional 
precautions  are  taken  such  as  having  a  mechanical  blaS'  applied  to  the 
monitor  sensor  plck-off  to  avoid  the  possibility  of  missing  a  failure  on 
a  normally  "null"  circuit. 

2.  System  Applications 

These  automatic  failure  detection  techniques  have  been  widely  used  in  the 
system  designed  for  both  the  VC  10  and  the  BAC  1-11.  As  a  further  example 
an  autoBiatlc  throttle  control  system  Is  illustrated  in  fig.  5.  The  air¬ 
speed  P-S  capsules  and  pressure  sources  are  fully  duplicated  along  with 
their  pick-offs,  but  there  Is  only  a  single  pick-off /amplifier  and  siotor/ 
gearbox  follow  up  system,  as  any  possible  failure  up  to  the  output  shaft 
of  the  gearbox.  Including  Jamming,  will  cause  an  output  error  to  be  developed 
In  the  second  plck-off,  which  conqprlses  the  failure  indicator.  This  does 
not  cover  failures  such  as  stripped  gears  or  loose  couplings  as  It  is  consid¬ 
ered  that  between  normal  Inspection  and  overhaul  periods  the  probability  of 
such  failures  occuring  would  be  adequately  remote.  This  particular  design 
employs  only  low  power  motors  and  mechanical  design  features  such  as  dup¬ 
licated  gear  pins  and  hence  this  low  failure  probability  is  a  reasonable 
assumption.  The  output  shaft  has  twin  output  synchros,  each  referenced 
from  twin  transmitter  synchros  In  an  airspeed  selection  controller.  One 
synchro  transformer  feeds  the  airspeed  error  signal  to  a  computer  and 
asplifler  where  It  Is  combined  with  a  pitch  angle  stabilisation  term. 

(As  part  of  the  main  autopilot  pitch  system  the  main  vertical  gyro  is 
also  continuously  coiiq>ared  for  vertlcallty  with  a  second  smnltor  gyro.) 

The  second  synchro  transformer  Is  an  airspeed  error  detector.  A  study  of 
fig.  5  will  show  that  If  any  airspeed  error  occurs  which  Is  not  merely  a 
short  term  perturbation  this  can  only  be  due  to  an  Internal  failure,  and 
hence  In  the  system  described,  an  assesssient  of  airspeed  error  is  the 
failure  detection  means.  Sladlar  automatic  failure  detection  means  can  be 
Integrated  Into  the  design  of  most  airborne  equipments.  For  example,  fig.  6 
Is  a  block  diagram  similar  to  one  half  of  the  VC  10  autoflare  system,  which 
uses  automatic  monitoring  to  a  wore  elaborate  degree  from  the  ILS  receiver 
and  radio  altlsmter  through  to  the  aircraft  power  controls.  All  categories 
of  automatic  monitoring  are  employed  In  a  fairly  economical  arrangement.  For 
example  the  ILS  receiver  uses  a  form  of  absolute  measurement  of  the  A.G.C. 
circuits  In  the  pure  receiver  stage  to  assess  the  carrier  and  Its  sndulatlon, 
while  the  output  filter  stage  is  fully  duplicated  and  assessed  by  comparison 
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monitoring.  Similarly,  one  version  of  the  radio  altimeter  employs  a 
transmitter  absolute  monitor  but  has  duplicated  receiver  elements  which 
are  compared  for  failure  detection.  The  control  coiq>uters  are  duplicated, 
although  some  sinqplification  is  possible  in  the  monitor  unit.  The  vertical 
gyro  is  directly  coiqtared  with  a  second  gyro  but  carries  all  multiple  out¬ 
puts  from  different  pick-offs  on  the  main  gimbal  output  or  from  output 
repeaters.  As  in  fig.  3  the  servo  is  performance  monitored  from  an  input- 
output  error  assessment.  This  system  differs  slightly  in  concept  from  that 
of  fig.  5  in  that  it  is  purely  an  aircraft  equipment  monitoring  scheme, 
which  takes  no  action  if  there  is  any  inadequacy  of  overall  performance. 

(The  automatic  throttle  system  of  fig.  5  as  well  as  providing  cover  against 
equipment  failures,  can  take  action  if  there  is  an  inability  to  hold  the 
airspeed,  as  airspeed  error  is  included  in  the  monitoring  loop.) 

3.  Failure  Analyses 

If  automatic  control  equipment  is  to  be  of  maximum  use  in  the  future,  then 
it  will  inevitably  assume  limited  responsibility  for  certain  aspects  of 
aircraft  safety,  and  in  such  cases,  it  is  vital  to  know  whether  or  not  the 
equipment  concerned  is  operating  correctly,  and  whether  the  failure  detection 
means  can  in  any  way  be  negated.  The  assessment  of  probability  of  correct 
operation  must  rely  heavily  on  failure  analysis,  but  unfortunately  with 
more  coiiq>lex  systems  this  is  becoming  virtually  impossible,  as  the  niimber 
of  failure  modes  and  combinations  can  reach  astronomical  figures.  However, 
the  use  of  coiiq>arison  monitoring,  which  usually  represents  a  major  proportion 
of  any  autooiatlc  monitoring  system,  by  its  very  nature,  simplifies  the  pro¬ 
blem  of  failure  analysis.  In  fact  only  those  points  in  a  system  which  are 
vulnerable  to  common  failures  affecting  both  a  main  control  lane  and  a 
monitor  lane  simultareously  require  detailed  analysis.  Sven  then,  if  a 
conmon  failure  is  shown  on  analysis  to  give  a  positive  disconnect  it  can 
be  acceptable.  For  example,  referring  back  to  fig.  5,  the  number  of  points 
requiring  detailed  failure  analysis  are,  the  common  Airdata  gearbox,  the 
vertical  gyro  output  drive,  the  controller  selector  drive  shafts  and  gears 
and  the  comparator,  which  oust  be  so  designed  that  any  failure  within  it¬ 
self  causes  the  sionitored  system  to  disconnect.  This  nuat  include  the 
possibility  if  a  widening  threshold  in  the  disconnect  logic  circuits  due 
to  component  drifts  as  well  as  disconnect  failures.  It  is  essential  to 
account  for  this  in  design  so  that  no  dormant  failure  in  the  disconnect 
device  can  prevent  a  serious  system  failure  from  being  detected  iimadiately 
it  occurs. 

It  will  be  realised  that  even  this  limited  aaiount  of  detailed  analysis 
is  more  elaborate  than  implied  by  fig.  6,  as  all  aspects  of  aircraft 
installation  and  interwiring  are  involved.  Fig.  7  illustrates  the  amgni- 
tude  of  the  task  in  practice.  This  is  an  interconnection  diagram  for 
one  monitored  autopilot,  i.e.  one  half  of  the  VC  10  installation.  The 
vulnerable  areas,  as  stated  before,  are  those  where  there  are  potential 
cross  connections  between  the  comparison  and  main  autopilot  units. 

These  areas  are  indicated  at  the  interface  of  the  main  autopilot  and 
coB^arison  sections  in  the  diagram.  Typical  examples  are  poWex  supplies 
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to  the  comparison  plck*o££  elements  in  the  Air  dete  sensor  end  throttle  and 
autopilot  controllers  and  corresponding  signal  lines  from  these  cosiparlson 
plck*o££  elements  back  to  the  coiqtarison  computer  itself.  However,  the 
amound  of  vital  failure  analysis  required  can  be  seen  to  be  trivial  in 
relation  to  what  would  be  involved  if  the  cooplete  system  were  not  covered 
by  automatic  monitoring  facilities.  In  fact  the  task  would  be  impossible 
in  practice  if  every  individual  element  were  subject  to  detailed  analysis 
of  all  of  its  failure  modes  —  even  if  they  were  known.  The  simplification 
of  failure  analysis  is  very  inqtortant  as  there  is  no  other  means  to  assess 
whether  a  system  will  meet  the  low  failure  probabilities  now  being  sought 
as  no  significant  amount  of  in-service  operational  experience  can  ever  be 
obtained. 

4.  Fail-safe  Design 

The  precautions  taken  in  the  VC  10  equipsient  design  to  ensure  that  the 
possibility  of  vital  failures  is  avoided  are  very  extensive.  In  fact, 
in  all  cases  where  there  was  any  doubt  the  most  positive,  if  somewhat 
uneconomical,  solution  was  adopted,  that  of  full  duplication,  even 
though  this  is  not  always  compatable  with  the  reduction  of  gain  tolerance 
problems. 

Some  typical  examples  of  the  practical  precautions  taken  in  the  design  of 
both  VC  10  and  BAG  1-11  all  weather  landing  systems  equipsmnt  are  as 
follows: 

(a)  All  "autopilot"  and  "comparison"  signals  and  power  supplies  are 
taken  through  separate  connectors  so  that  the  possibility  of 
pin  to  pin,  pin  to  shell,  or  other  common  electrical  failures 
between  the  two  control  and  information  lanes  is  avoided.  The 
one  exception  to  this  is  the  Hsrconi  ILS  glide  slope  receiver 
which  has  the  two  separate  filter  outputs  on  the  same  connector. 
This  was  desirable  in  order  to  maintain  ARIMC  standardisation 
and  it  is  pemdLssible  because  detailed  failure  analysis  has  shown 
that  no  cosBBon  failure  is  possible  which  does  not  also  cause  a 
system  automatic  disconnect.  This  is  an  example  of  a  general 
case  mentioned  before  in  which  common  failures  between  auto¬ 
pilot  and  monitor  channels  are  permissible! 

(b)  Separate  power  supplies  are  provided  for  main  autopilot  and 
monitor  elements.  This  ensures  that  no  cosason  power  supply 
failure  can  go  undetected,  even  for  the  briefest  period. 

Where  power  sources  ultisuitely  come  together,  as  required  by 
main  electrical  system  protection  arrangements,  a  limited, 
but  adequate  number  of  power  failure  detector  switches  are 
employed.  In  the  main  however,  separate  power  supplies  are 
necessary,  as  the  majority  of  failures  are  in  the  class  of 
open  circuit  secondary  windings  on  trsnsformers ,  and  such¬ 
like,  and  these  will  rarely  reflect  a  sufficient  change  in 
load  to  operate  a  busbar  power  failure  switch. 
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(c)  Coiq>arator/dl8connect  devices  are  required  In  several  places  in 
the  VC  10  system  and  these  have  been  especially  designed  to  be 
fall-safe.  That  la,  any  Internal  failure,  must  cause  a  dis¬ 
connect,  just  as  If  It  occurred  within  the  autopilot  or  monitor 
lanes.  The  alternative  Is  to  have  a  failure  survival  comparator 
device  which  will  continue  to  work,  by  means  of  redundance, 
following  a  failure.  Unfortunately,  such  a  device  requires 
regular  checking  to  determine  Its  redundancy  status  and  this  Is 
considered  to  be  a  serious  disadvantage.  (In  newer  designs  a 
partial  failure  indicator  technique  has  been  developed  to  over¬ 
come  this  difficulty  using  electroluminescent  panel  Indicators 
on  the  computer  bcnces,  but  this  Is  not  suitable  for  the  VC  10 

or  BAC  1-11  Installation.) 

To  obtain  the  required  degree  of  fall  safety  In  the  comparator/ 
disconnect  requires  very  careful  design  and  the  scheme  adopted 
by  Elliotts  Is  Illustrated  dlagrammatically  in  fig.  8.  It 
comprises  two  non-linear  amplifier  Input  elements,  carrying 
autopilot  and  monitor  lane  information  respectively.  These  are 
compared  and  within  the  limits  of  equality  specified,  the  com- 
'  parator  element  outputs  an  AC  signal.  This  In  turn  excites 
a  "zeroquleacent"  bistable  amplifier  which  oscillates  and 
.energises  a  pair  of  engage/disconnect  relays  so  long  as  the 
excitation  Is  present.  If  the  excitation  disappears  due  to 
an  error  arising  between  the  autopilot  and  sonltor,  or  due  to 
an  Internal  failure  anywhere  In  the  'comparator  device.  Including 
open  circuit  wiring  or  widening  of  the  disconnect  threshold 
locll,  then  the  aa^lifler  will  cease  to  oscillate  and  the  dupli¬ 
cated  relays  will  drop  out  causing  a  disconnect.  Slndlar  fall- 
safe  characteristics  can  be  obtained  by  other  methods  but  the 
particular  design  described  Is  very  stable  and  holds  disconnect 
thresholds  under  normal  operating  conditions  to  about  ***  3X,  even 
In  the  presence  of  drift  of  component  values  over  the  life  of  the 
equipment . 

(d)  As  stated  before  any  comparator/disconnect  device  Is  vulnerable 
to  comsnn  failure  problesis  and  this  applies  equally  to  the  auto¬ 
pilot  engage  circuit  of  which  the  comparator/disconnect  switch 
Is  an  Integral  part.  For  exaa^le,  any  '^hang-up"  In  the  engage 
circuits  after  the  coaq>arator  has  signalled  a  disconnect  could 
be  very  serious,  and  any  possibility  of  this  must  be  completely 
eliminated. 

To  this  end  a  completely  new  engage  circuit  concept  Is  used  In 
the  VC  10.  The  basis  of  this  Is  a  "floating"  power  supply 
separately  derived  and  Independent  of  the  other  autopilot 
supplies.  This  supply  Is  115  V.  d.c.  and  the  circuit  Is  of  such 
an  Impedance  that  It  cannot  be  effectively  energised  by  any 
other  aircraft  supply  through  any  "fault"  or  "sneak"  path.  In 
any  case,  two  coherent  failures  would  be  necessary  to  effect  any 
"hang-up".  In  addition,  parts  of  the  circuit  arc  duplicated  and 
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all  relays  have  been  designed  to  have  exceptionally  high  zesldual 
holding  voltages  so  that  there  Is  no  tendency  to  hold  In  other 
than  when  correctly  energised. 

(e)  All  wiring  and  Intercabllng  from  the  separate  autopilot  and 
nonltor  connectors  la  kept  separated  as  far  as  possible  but 
where  coimion  cable  ducting  Is  used  a  dielectric  barrier  Is 
Imposed  between  the  two  bundles  of  wires. 

(f)  Autopilot  and  conparlson  manometrlc  Information  is  obtained  from 
separate  pitot  heads  and  static  vents  so  that  simultaneous 
failures  of  both  control  and  comparison  lanes  due  to  such  pro¬ 
blems  as  Icing  or  insect  or  bird  blockage  Is  avoided.  This  Is 
Important  to  all  weather  landing  In  relation  to  auto  throttle 
control  requirements. 

(g)  The  pilots'  controllers,  both  main  autopilot  and  throttle,  have 
separate  sections,  mechanically  and  electrically  Isolated,  for 
autopilot  and  comparison  monitor  demands.  The  autopilot  con¬ 
troller  Is  Illustrated  In  fig.  9  and  Its  Roll  and  Pitch  section 
Is  shown  In  fig.  10.  This  Is  a  dual  controller  but  the  main 
elements  of  one  of  the  monitored  autopilots  are  In  full  view. 

The  pitch  wheels  connect  through  a  worm  gear  to  a  clutch  which 
couples  the  drive  to  a  pair  of  ganged  and  matched  pitch  potentio¬ 
meters.  With  the  coupling  clutch  disengaged  the  potentiometers 
are  centred  with  a  spring  loaded  cam  mechanism. 

The  Important  requirement  of  this  siechanlsm  Is  that  any  failure 
which  could  endanger  the  operation  of  the  aircraft  when  on  auto¬ 
pilot  must  cause  an  Imnedlate  automatic  disconnect.  In  the  case 
of  the  manual  pitch  controls,  when  the  autopilot  Is  engaged  In 
one  of  the  lock  modes  or  In  autoflare,  the  coupling  clutch  Is 
de- energised  and  the  centering  solenoid  Is  disengaged  from  the 
ganged  potent lomoters.  These  are  then  held  in  the  trlmned 
position  which  exists  on  engaging  the  mode  by  means  of  a  brake. 
Hence,  if  energisation  of  the  centering  solenoid  falls  the  cen¬ 
tering  cam  and  follower  will  cause  the  ganged  potentiometers  to 
snap  to  centre  slsultaneously.  Hence  both  the  autopilot  and 
monitor  channels  will  receive  the  same  input  and  on  the  face 
of  It  no  disengagement  will  be  demanded,  although  due  to  the 
failure  the  autopilot  will  be  subjected  to  step  Input  pitch 
disturbance.  In  fact  due  to  a  small  difference  In  high  fre¬ 
quency  responce  between  the  autopilot  and  monitor  channels, 
a  disconnect  will  probably  occur,  but  sosMthlng  more  certain 
is  necessary  without  having  to  adopt  the  grossly  uneconomical 
solution  of  coivleta  duplication  of  everythina.  In  fact,  the 
principles  outlined  in  the  foregoing  have  been  applied  and 
the  design  precautions  taken  to  ensure  this  complete  failure 
detection  capability  are  as  follows:  First  the  pitch  wheels 
are  double  locked  to  the  worm  pinion  shaft  and  the  mechanism  is 
stout  enough  to  be  adequately  failure- free.  All  bearings  are 
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exact  fits  in  the  main  castings  (not  interference  fits)  so  that 
even  if  an  inner  race  Jam  was  experienced  at  any  point  a  reason¬ 
able  excess  pressure  would  cause  an  outer  race  to  rotate  on  the 
main  casting. 

The  further  working  principles  of  the  pitch  controller  can  be 
seen  by  reference  to  the  circuit  diagram  on  fig.  10.  When  the 
autopilot  engage  switch  is  depressed  the  centering  clutch  is 
energised  which  releases  the  centering  cam  follower  and  in  the 
same  motion  applies  a  light  brake  to  the  centering  cam.  This 
movement  also  operates  a  microswitch  which  completes  the  engage 
interlock  circuit  and  allows  the  autopilot  to  lock  into  engage¬ 
ment,  while  at  the  same  time  the  microswitch  action  inserts  a 
register  into  series  with  the  coil  of  the  centering  solenoid  in 
order  to  reduce  its  current  drain  to  holding  level  only.  Also 
at  the  same  time  the  coupling  clutch  is  energised  and  pitch  in¬ 
puts  can  be  applied  via  the  pilots  pitch  wheels.  When  the  further 
modes  such  as  auto-flare  are  selected,  the  coupling  clutch  is 
de-energised,  leaving  the  ganged  potentiometers  in  the  position 
existing  at  the  time  of  selection,  held  by  the  brake. 

HoM  the  effect  of  failures  can  be  examined.  First,  taking  the 
example  already  mentioned,  if  the  centering  clutch  falls,  the 
two  ganged  potentiometers  will  snap  to  centre,  but  at  the  saoie 
instant  the  microswitch  will  break  the  engage  interlock  circuit 
and  the  autopilot  will  disengage  as  required.  Mow  consider  a 
failure  of  the  microswitch  in  the  operated  position,  due  to  say 
a  welding  of  contacts,  or  a  Jamned  plunger.  Then  on  the  first 
occasion  that  the  autopilot  is  disengaged  and  then  later  re¬ 
engaged  the  centering  clutch  solenoid  will  drop  out,  but  cannot 
be  brought  in  again  due  to  the  current  restriction  of  the  series 
resistor.  Now  the  centering  torque  of  the  cam  and  follower  in 
the  detent  position  is  deliberately  very  much  larger  than  the 
torque  which  can  be  carried  by  the  coupling  clutch  and  hence  in 
this  case  the  potentiosteter  cannot  be  moved  by  operation  of  the 
pitch  wheels.  Hence  there  are  now  two  desirable  situations. 

First  the  ganged  potentiometers  cannot  be  put  off-centre  again, 
which  could  be  dangerous  on  subsequent  engagesient  of  a  lock  siode, 
and  second,  the  pilot  will  discover  that  his  pitch  wheels  are  not 
effective  and  will  "snag"  the  system,  which  will  result  in  the 
failed  microswitch  being  discovered.  The  probability  of  a 
dangerous  combination  of  failures,  resulting  from  a  failed  micro- 
switch  and  a  centering  clutch  failure  in  the  same  critical  period 
of  a  flight  is  tremendously  remote.  Similarly  failures  such  as 
shorted  external  terminals  on  the  microswitch  can  be  avoided  by 
design  and  manufacturing  precautions  and  in  fact  further  detailed 
analysis  will  show  that  all  other  possible  failures  cannot  escape 
detection  and  the  overall  fall-safe  requirement  is  met. 
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This  is  an  Important  example  of  failure  analysis  of  simplified 
designs  which  use  a  minimum  of  redundancy.  The  example  also 
illustrates  cleaily  the  type  of  design  action  which  can  be  taken 
to  force  "so-called"  dormant  failures  to  reveal  themselves. 

These  are  failures  which  do  not  affect  the  Innediate  operation 
of  the  system,  but  which  remove  any  element  of  redundancy  or 
other  safety  cover  which  could  leave  the  system  at  the  mercy 
of  a  subsequent  failure. 

The  seven  examples  above  were  chosen  to  give  a  cross-section  of  the  type 
of  problem  involved  in  the  design  of  systems  with  automatic  failure  detection 
facilities.  More  information  on  the  overall  concepts  is  available  from 
papers  in  the  list  of  references. 

5.  Nuisance  Disconnects 

The  pursuit  of  siiq>licity  in  automatic  monitor  system  design  reflects 
directly  into  the  level  of  nuisance  dieccnnects  likely  to  arise  due  to 
differences  in  the  characteristics  of  the  automatic  pilot  and  'Monitor 
lanes.  Normally  the  simpler  the  system  the  higher  the  nuisanwc  disconnect 
level.  This  is  minimised  in  the  VC  10  by  the  fundamental  concept  of  moni¬ 
tored  system  design  which  employs  cross  comparison  between  like  elements, 
rather  than  complete  signal  chain  comparison,  and  also  by  the  techniques 
of  signal  consolidation  (see  references  1,  2  and  3).  However,  limits 
must  be  put  on  the  levels  which  are  acceptable  and  these  differ  consid¬ 
erably  on  whether  or  not  failure- survival  is  required.  For  example,  a 
nuisance  disconnect  of  a  single  fail- soft  system  installation  at  the 
wrong  time  can  be  very  embarrassing,  if  not  dangerous,  whereas  with  a 
fail -operative  system,  like  the  duplicated  monitored  installation  as 
in  the  VC  10,  it  would  be  classed  merely  as  a  form  of  failure  of  the 
first  system  which  would  demand  an  autochangeover.  In  this  context  so 
long  as  it  did  not  occur  at  a  rate  more  than  once  per  50  hours  operation 
it  vrould  be  perfectly  acceptable  from  the  safety  viewpoint  —  although 
not  by  any  means  acceptable  for  serviceability  and  confidence  reasons. 

In  practice  the  VC  10  system  calls  for  a  minimum  nuisance  disengagement 
level  of  one  per  1000  hours  for  each  cross-monitored  section  of  each 
half  of  the  complete  installation  which  gives  a  considerable  safety  and 
confidence  siargin. 

There  are  cases  where  design  actions  are  taken  entirely  to  alleviate  the 
nuisance  disconnect  problem.  For  example,  a  well  known  one  is  the  case 
of  rate  gyros  in  roll  and  pitch  control  axes.  The  type  of  rate  gyro 
used  in  the  VC  10,  in  conjunction  with  its  bandpass  input  filter,  cannot 
develop  a  dangerous  demand  due  to  a  failure  and  the  effect  of  a  failure 
does  not  result  in  anything  oiore  than  a  less  comfortable  ride.  Hence 
it  is  unnecessary  to  detect  the  failure  rapidly  and  hence  duplication 
of  the  gyro  for  monitoring  purposes  is  not  economic.  However,  the 
effect  of  the  rate  gyro  input  to  the  main  autopilot  control  chain  can 
create,  under  certain  disturbance  conditions,  sufficient  dynamic  differ¬ 
ence  between  the  two  information  lanes  to  cause  an  automatic  disconnect. 

The  solution  to  this  is  to  cross- feed  the  rate  gyro  infonnatlon  used 
for  control  purposes  into  the  monitor  chain  so  as  to  eliminate  any 
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discrepancy.  This  unfortunately  then  gives  a  possibility  of  a  comnon 
failure  In  the  autopllot/nonltor  combination,  but  In  the  VC  10  Installa¬ 
tion  tests  carried  out  with  all  conceivable  types  of  failure  have  given 
acceptable  results.  In  future  designs  a  twin  plck-off  monitored  gyro 
may  be  favoured  and  development  of  such  units  Is  proceeding. 

6.  System  Testing 

In  relation  to  the  VC  10  programne  a  considerable  amount  of  ground 
testing  has  been  completed  using  actual  autopilot  and  monitor  equipment 
on  the  Vickers  "Iron  Bird"  rig.  This  has  covered  all  flight  conditions 
and  modes  of  operation.  Assessment  of  the  rig  when  In  operation  has 
been  effected  by  plotting  continuously  against  each  other  the  main 
autopilot  and  cos^arlson  demands  on  a  background  of  disconnect  thresh¬ 
old  settings.  This  gives  useful  Information  In  that  the  number  of 
occasions  a  near  disconnect  Is  obtained  is  assessable  and  from  the 
predications  on  actual  nuisance  disconnect  frequency  can  be  made.  An 
X-Y  plotter  Is  also  Installed  In  one  VC  10  test  aircraft  for  the  same 
type  of  continuous  recording  assessment.  A  typical  recording  Is  shown 
In  fig.  11.  The  ordinate  is  the  comparison  monitor  lane  output,  and 
the  abscissa  the  autopilot  signal  modified  by  the  servo-actuation  system 
Inverse  transfer  function. 

Conclusion 


This  paper  has  dealt  with  certain  concepts  and  techniques  related  to 
automatic  failure  monitoring  in  airborne  equipment  and  It  assumes  some 
previous  knowledge  of  the  overall  VC  10  system  concepts  as  outlined  In 
the  referenced  papers.  The  techniques  described  are  analogous  to  those 
which  have  been  employed  for  many  years  In  design  of  aircraft  structures, 
engines,  flying  control  systems  and  many  others.  Mhen  such  techniques 
are  more  widely  used  by  autopilot  designers,  it  may  be  possible  to 
Increase  the  reliance  placed  in  these  systems,  even  to  the  extent  of 
allowing  them  part  responsibility  for  aircraft  overall  safety. 

It  is  our  experience  that  although  these  techniques  are  often  simple 
and  easy  to  apply  in  theory,  they  are  not  always  easily  achieved  in 
practice,  as  one  design  nicety  can  so  easily  be  negated  by  another 
seeming  refinement.  It  Is  essential  to  maintain  vary  critical  control 
over  manufacturing,  Inspection  and  service  requirements  and  to  ensure 
that  no  cosmon  failure  possibility  creeps  into  a  design,  and  only  when 
complete  engineering  and  design  organisations,  in  both  equipsient  and 
aircraft  comnanies  become  familiar  with  the  failure  detection  design 
techniques  do  the  best  and  safest  systems  emerge. 
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FIGI.  THE  DUPLICATE  MONITORED  SYSTEM  IN  THE  VCIO 
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SUMMARY 


The  paper  reviews  the  requirements  for  all  weather  landing  systems  on 
a  short  haul  Jet  from  the  aircraft  manufacturer's  point  of  view,  with, 
of  course,  particular  reference  to  the  BAG  One-Eleven.  The  problems 
of  producing  a  flexible  system  which  will  suit  many  different  types  of 
operator,  with  differing  operational  environments  is  discussed. 

The  basic  provisions  made  in  the  aircraft  and  the  basic  automatic  system 
for  subsequent  easy  fitment  of  all  weather  landing  systems  are  described 
and  a  number  of  possible  alternative  systems  listed,  which  build  up  from 
the  basic  single  autopilot  to  a  fully  automatic  all  weather  landing 
system.  The  potentialities  of  each  of  these  systems  in  terms  of  removli^ 
existing  obstacles  to  lower  minima  are  tabulated. 

The  major  firm  BAG  One-Eleven  development  project  -  that  of  safe  autoflare 
is  described.  This  project  is  Intended  to  result  in  the  autoflare  system 
being  available  for  airline  use  in  1966. 

It  l8~recognlzed  that  systems  which  do  not  go  as  far  as  safe~autoflare 
may  confer  some  benefit  -  although  the  benefits  to  be  obtained  are  hard 
to  predict  quantitatively  -  and  may  be  attractive  to  some  operators.  On 
the  other  hand  a  fully  automatic  failure  survival  system  will  almost  cer¬ 
tainly  be  required  to  meet  the  full  Phase  III  requireaient .  The  ability 
of  the  BAG  One-Eleven  to  accommodate  this  wide  range  of  possible  system 
requirements  is  described. 

1.  INTRODOGTIOH 

The  Bianufacturer  of  the  short  haul  airliner  finds  himself  subject  to 
many  opposing  pressures  today  when  the  question  of  all  weather  landing 
facilities  for  his  new  project  is  considered. 

On  the  one  hand,  he  has  to  take  note  of  the  increasingly  serious  Interest 
being  shown  world  wide  in  the  all  weather  landing  problem,  and  the  number 
of  solutions  being  propounded  -  sosie  of  which  are  within  comparatively 
short  time  of  entering  airline  service.  On  the  other,  he  has  to  appreciate 
that  if  his  aircraft  is  to  appeal  to  the  small  operator  as  well  as  the 
large,  it  must  be  as  siiq>le  to  operate  and  maintain  as  possible  and  in¬ 
expensive  in  first  cost. 

Because  of  the  wide  variety  of  operators,  with  greatly  differing  route 
structures  and  climatic  conditions,  who  form  the  potential  market,  the 
systems  designed  should  be  flexible  -  that  is,  ideally  they  should  be 
such  that  a  number  of  alternatives  can  be  offered  which  range  from  a 
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straightforward  single  channel  autopilot  only,  up  to  a  full  automatic 
solution.  The  intermediate  stages  between  these  two  extremes  are  difficult 
to  define,  but  there  is  little  doubt  that,  on  an  aircraft  like  the  BAG 
One-Eleven,  there  is  also  a  demand  for  something  which  will  permit  soma 
lowering  of  minima  without  going  all  the  way  to  full  blind  landing. 

The  economics  of  fitting  an  all  weather  landing  system  to  a  short  haul 
jet  are  rather  different  to  those  on  the  larger  long  range  machine.  The 
safety  standards  must  be  just  as  high  7  perhaps  higher  because  of  the 
shorter  average  flight  time  and  hence  the  greater  nundier  of  landings 
made  during  the  life  of  the  aircraft.  iHence  to  achieve  the  same  objective, 
the  quantity  of  equipment  required  will  be  the  same.  Whereas,  however, 
the  cost  of  the  equipment  may  represent  only  three  or  four  per  cent  of 
the  first  cost  of  a  long  range  jet,  it  could  represent  up  to  nine  or  ten 
per  cent  on  the  short  haul  jet.  This,  of  course,  has  a  significant  effect 
on  seat  mile  costs  and  the  economic  benefits  oftained  must  be  correspond¬ 
ingly  greater.  Many  atteoq)ts  have  been  made  by  different  organizations  to 
obtain  a  realistic  assessment  of  the  benefits  to  be  gained,  from  lowered 
minima,  but  the  imponderable  factors  such  as  the  growth  of  traffic  which 
might  result  from  improved  regularity  and  safety  make  these  assessments 
dubious.  It  is,  however,  reasonable  to  assume  that  improved  regularity 
has  a  bigger  impact  on  the  economics  of  a  short  haul  jet. 

A  prospective  passenger  can  in  general  find  alternative  transport  with 
much  less  inconvenience  for  a  short  st^ge.  For  instance,  he  is  such  more 
likely  to  drive  his  car  from  New  York  td  Atlantic  City  if  thif  weather 
seems  dubious,  than  he  is  to  change  his  air  passage  to  sea  if  travelling 
from  New  York  to  London. 

It  is  doubtful  whether  the  true  economics  of  the  situation  will  be  known 
until  several  years  of  operational  use  have  been  obtained,  but  it  seems 
reasonable  to  expect  that  the  balance  of  cost  and  revenue  saving  will  be 
at  least  as  favourable  on  a  short  haul  jet  as  on  a  long  range  machine. 

In  addition  to  the  influence  of  the  general  considerations  outlined  in 
the  foregoing  remarks,  the  philosophy  of  the  BAG  One-Eleven  was,  of 
course,  inevitably  influenced  by  the  work  on  automatic  landing  carried 
out  on  the  VCIO.  Although  the  circumstances  of  the  two  aircraft  are 
greatly  different,  the  bacl^round  experience  of  automatic  landing  develop¬ 
ment  work  on  the  VCIO  is  a  tremendous  asset  to  the  BAG  One-Eleven.  As  is 
probably  now  well  known,  the  VClO'^s  first  major  customer,  B.O.A.C. , 
declared  it's  intention  to  specify  a  fully  automatic  landing  system  for 
the  VCIO  at  an  early  stage  of  design,  to  be  based  on  the  B.L.E.U.  principle, 
and  to  full  civil  safety  standards.  Military  versions  of  the  aircraft  will 
also  carry  the  system. 

The  BAG  One-Eleven,  however,  had  no  such  backing  from  a  customsr  placing 
a  large  order  in  the  early  stages  and  the  provisions  made  for  all  weather 
landing  had  to  be  based  on  BAG'S  assessmsnt  of  likely  requirements.  It  is 
no  secret  that  a  recent  customer  -  Aer  Lingus  -  has  dsclarad  it's  interest 
in  automatic  landing  for  the  aircraft  and  that  a  firm  BAG  project  now  exists. 
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The  min  body  of  this  paper  describes  the  systems  now  under  development 
and  discusses  the  possible  stages  which  are  being  offered. 

2.  SYSTEM  PHILOSOPHY 


2.1  General 


Successful  Introduction  of  operations  In  worse  weather  conditions  than 
are  permitted  today  will  not  be  achieved  If  there  Is  any  possibility  of  a 
deterioration  In  safety  standards. 

The  task  of  winning  the  confidence  of  the  travelling  public,  the 
certificating  authorities  and  the  airline  pilots  Is  not  going  to  be 
easy. 

The  target  for  coiq>lete  system  reliability  Is  that  the  maKlmum  risk  of 
a  fatal  accident  when  using  the  landing  system  should  be  one  In  ten 
million.  Obviously,  the  achievement  of  the  standard  cannot  be  demonstrated 
absolutely  In  practice  before  the  system  enters  service,  but  It  should  at 
least  be  demonstrable  theoretically  by  rigorous  fault  analysis.  Cautious 
Introduction  Into  service,  with  Initial  clearance  to  weather  minima  which 
are  less  severe  than  the  final  target.  Is  envisaged  with  progressive  lower¬ 
ing  of  minima  as  operational  experience  Is  obtained. 

The  Likelihood  of  alL-weather  landing  systems  being  specified  for  the 
aircraft  had  an  Impact  on  the  basic  design  of  the  aircraft  and  also 
on  the  design  of  the  basic  automatic  control  system. 

2.2  Effects  on  basic  design 

The  BAC  view  on  the  ultimate  (l.e.  Phase  III)  all  weather  landing  system 
solution  Is  that  It  will  Involve  system  redundancy.  To  make  the  system 
redundancy  concept  valid.  It  must  be  applied  to  all  links  In  the  chain. 
Including  the  mechanical  control  circuits  and  the  electrical  power  gener¬ 
ation  system.  Where  the  use  of  an  undupllcated  component  Is  Inevitable, 
the  reliability  of  that  coaqponent  must  be  demonstrably  so  high  that  the 
standard  Is  maintained.  This  Is  possible  for  certain  mechanical  elements. 

Generating  system 

Fig.  2  gives  a  schematic  diagram  of  the  electrical  generating  system.  A 
separate,  normally  completely  independent  power  source  Is  available  for 
each  of  the  duplicated  automatic  control  systems  which  would  be  used  In 
a  full  phase  III  automatic  landing  system.  This  Is  consistent  with  the 
general  philosophy  of  redundant  systems.  Most  single  failures  In  one 
generating  system  lead  to  an  automatic  switching  of  Its  loads  to  the 
second  generator,  thus  avoiding  an  unnecessary  changeover  of  automatic 
control  systems.  The  exception  to  this  Is  the  failure  of  a  bus  bar, 
which  would  cause  that  generating  system  to  become  dead  and  an  auto¬ 
matic  changeover  of  automatic  control  systems  to  take  place. 
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A  third  source  of  electrical  power  Is  available  on  the  aircraft  -  from 
the  A.F.U.  -  and  It  Is  possible  that  this  may  be  used  to  improve  the 
overall  reliability  still  further  In  the  ultimate  system.  It  could 
for  Instance  be  used  to  allcw  automatic  landing  at  the  end  of  a  flight 
during  which  a  generator  failure  has  been  experienced. 

Control  circuits 


The  likelihood  of  mechanical  failures  within  the  control  circuits  of 
the  basic  aircraft  during  the  landing  phase  has  to  be  assessed  and  if 
any  are  found  which  are  of  comparable  probability  to  a  failure  of  an 
electronic  system,  the  system  philosophy  is  of  course  Invalidated. 

In  practice,  this  would  be  extremely  unlikely  since  the  basic  aircraft 
would  be  unacceptable  In  this  condition.  Vulnerable  mechanical  elements 
In  the  control  circuits  of  the  BAG  One-Eleven  are  duplicated.  The  gsain 
effect  of  the  all  weather  landing  system  on  the  design  of  the  control 
system  was  to  ensure  that  the  servo  actuators  of  the  duplicate  automatics 
could  be  engineered  Into  the  circuit  In  such  a  way  that  no  single  control 
circuit  failure  could  lose  both  automatic  systems.  For  example,  the  auto¬ 
flare  system  required  two  pitch  channels  and  the  servos  for  each  are 
coupled  Into  the  duplicated  elevator  cable  circuits  as  shown  In  Fig.  8. 

2.3  Basic  automatic  pilot  system  and  Its  development  potential 

Fig.  3  Is  a  block  schematic  diagram  of; the  Bendix  PB20D  system  as 
originally  designed  for  the  BAG  One-Eleven  aircraft.  It  differs  in 
two  areas  from  the  PB200  system  as  Installed  In  other  aircraft  although 
It  Includes  TALI,  programme  developments  Including  the  type  18729  aiiq>ll- 
fler  computer.  The  two  main  differences  of  equipment  are  the  stablllssr 
trim  servo  motor  and  the  inclusion  of  the  torque  limiter  adaptor  unit. 
This  unit,  which  Is  Included  In  the  pitch  axis  Is  a  sliiq>llfled  monitor 
unit.  It  Is  utilised  as  a  means  of  limiting  the  accelerating  forces 
applied  to  the  aircraft  due  to  a  "hardover"  to  one  "excess  g"  or  less 
whilst  allowing  the  autopilot  adequate  authority  to  provide  good  per¬ 
formance  In  all  operating  conditions,  particularly  during  coupled 
approaches.  This  authority  level  could.  If  a  protection  system  was 
not  provided,  allow  greater  than  one  excess  'g*  to  be  applied  to  the 
aircraft  in  a  "hardover"  condition.  A  conventional  torque  limiter  would 
not  provide  adequate  protection  against  this  condition,  particularly  In 
the  low  speed  flight  case. 

The  T.L.A.  unit,  which  Incorporates  signal  limiters  of  air  data  and 
glide  slope  commands,  provides  the  system  with  the  basis  of  a  "fall 
soft"  pitch  axis.  The  monitoring  unit  therefore  provides  a  "low 
disturbance"  disconnect  protection  system  during  low  speed  flight, 
l.e.  during  holding  and  approach  phases  In  the  pitch  axis  against 
"hardover"  failures,  but  in  order  to  provide  a  "fall  soft"  system 
of  the  type  necessary  for  automatic  approaches  to  low  altitudes  it 
Is  necessary  to  cover  the  "slow  over"  type  of  failure  and  to  provide 
the  full  protection  In  both  longitudinal  and  lateral  axes. 
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During  development  Inveitlgatlone  and  design  work  It  became  clear  that 
onward  development  of  this  system,  as  shown,  to  a  fully  monitored  fall 
soft  autopilot,  with  automatic  throttle  control,  autoflare  coinputatlon, 
failure  survival  In  the  pitch  axis,  and  eventually  a  full  failure  sur> 
vlval  automatic  landing  system,  was  not  acceptable.  It  would  be  costly, 
would  not  be  economic  to  maintain  In  service,  and  would  not  result  In  a 
good  engineering  job,  In  either  the  equipment  or  the  Installation.  In 
addition.  It  would  not  be  possible,  without  sacrificing  Interchangeability 
with  other  FB20  Installations,  to  even, approach  the  standard  of  Integrity 
necessary  for  a  "1  x  10~'"  system.  Itiwas  therefore  decided  to  take 
advantage  of  Elliotts'  and  our  own  development  work  on  the  VCIO  auto¬ 
matic  landing  system  and  utilise  the  separately  packaged  pitch  axis  and 
lateral  axis  amplifier/ computers  to  replace  the  type  18729  amplifier 
conqputer,  and  to  replace  the  type  4918  air  data  sensor  with  a  modularised 
unit,  to  which  extra  modules  are  easily  added  to  provide  additional 
facilities.  Including  self  monitoring. 

The  basic  autopilot  system  now  consists  of  the  units  shown  In  Fig.  4. 

The  changes  made  to  the  system  still  allow  a  large  degree  of  Inter¬ 
changeability  with  PB20  systems  at  unit  level,  for  example  the  servos 
and  their  mountings,  the  three  axis  race  unit  and  dynamic  vertical 
sensor. 

In  addition,  the  longitudinal  and  lateral  amplifier/ computers.  In  the  VClO 
system  contain  a  large  proportion  of  P^20  card  modules.  When  these  units 
are  applied  to  the  BAG  One-Eleven,  this' proportion  increases  to  almost 
the  equivalent  of  the  Bendlx  18729  unit.  However,  where  development  work 
on  the  VCIO  system  by  Elliotts,  or  TALL  programme  Improvements  can  be 
applied  with  advantage,  then  this  Is  done.  Some  card  modules  will  there¬ 
fore  be  changed  In  detail  design,  to  Improve  performance  reliability  or 
Integrity. 

The  change  to  the  system  shown  In  Fig.  4  brings,  therefore,  the  following 
advantages : 

a)  The  basic  units  of  the  system,  l.e.  the  amplifier  computers 
and  longitudinal  monitor  have  been  designed  to  the  rigid  safety 
standards  needed  to  meet  the  "lx  lO’^"  requirements  for 
automatic  landing 

b)  (a)  Is  achieved  using  well  known  components  and  equipments  which 
are  familiar  to  service  personnel 

c)  As  Is  shown  in  the  accompanying  diagrams,  by  the  addition  of 
units  or  sub-components  already  In  use  In  the  system.  It  Is 
possible  to  provide  duplication  where  required 

d)  The  system  can  be  built  up,  progressively,  to  the  various 
standards  of  all  weather  system  described  in  Section  3 
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3. 


MAJOR  STEPS  TOWARDS  FULL  ALL  WEATHER 
LANDING  OM  THE  BAG  ONB-ELEVEN 


As  was  stated  In  the  introduction,  it  is  recognised  on  the  BAG  One* 
Eleven,  that  some  operators  will  not  wish  to  go  as  far  as  others  on 
the  all  weather  landing  road,  and  there  follows  a  brief  description 
of  the  alternative  standards  being  considered,  some  of  which  are  firm 
projects  and  some  of  which  are  only  under  consideration. 

Stage  1 

Basic  single  PB20D  autopilot  with  torque  limit  adaptor  for  soft  pitch 
hardover  characteristic  as  shown  in  Fig.  A. 

Stage  2 

'Split  axis  computer'  Elliott/Bendlx  autopilot,  with  pitch  monitor  as 
shown  in  Fig.  A.  This  system  is  designed  to  be  extended  to  autoflare 
or  automatic  landing. 

Stage  3 

A 'Tail  soft"  system  as  shown  in  Fig.  5.  This  is  achieved  by  the  addition 
of  lateral  monitoring  to  Stage  2. 

Stage  A 

A  "fail  soft"  system  with  automatic  throttle  control  (Fig.  6)  either 
controlled  from  air  speed  and  pitch  signals,  or  from  angle  of  attack 
plus  acceleration  such  as  SCAT  provides. 

Stage  5 

A  "single  channel"  autcflare  system  as  represented  by  system  Ho.  1  in 
Fig.  7  (with  the  second  pitch  axis  servo  not  included)  but  with  the 
automatic  throttle  system  Included.  The  situation  display  system  could 
be  utilised  in  this  system. 

Stage  6 

The  full  autosmtlc  flareout  system  as  shewn  in  Fig.  7,  with  failure 
Survival  in  pitch  axis  automatics,  automatic  throttle  control,  situa¬ 
tion  displays  and  the  whole  system  being  designed  to  met  the  A.R.B. 
requiremnts  of  a  1  x  10~^  probability  of  a  fatal  incident  for  the 
critical  phase  of  the  approach,  flareout  and  landing. 

The  expectation,  in  term  of  reduced  minim,  from  autoflare  is  the 
subject  of  considerable  discussion.  It  is  hoped  that  100  ft.  ceiling 
and  of  the  order  of  AOO  yds.  R.V.R.  is  reasonjd>le. 
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Experimental  investigation  of  cofl^>lete  transition  from  I.F.R.  to 
V.F.R.  tends  to  show  that  this  is  not  feasible  with  safety  in  weather 
conditions  this  poor.  With  autoflare,  however,  the  transition  is 
only  in  azimuth. 

The  pilot  continues  to  be  relieved  of  two  of  his  three  main  tasks, 
l.e.  control  of  pitch  and  speed,  and  can  therefore  be  expected  to 
handle  the  azimuth  transition  with  safety  at  a  low  level.  The  level 
at  which  transition  in  azimuth  will  be  carried  out  will  be  largely 
dictated  by  the  quality  of  the  localiser.  If  the  locallser  is  such 
that  it  has  good  characteristics  at  all  altitudes  down  to  touch  down, 
there  appears  to  be  no  reason  why  the  azimuth  transition  should  not  be 
left  until  somewhere  near  the  flare  commencement  height.  If  on  the 
other  hand  the  locallser  is  poor  it  could  be  the  limiting  factor  on 
break  off  height.  Obviously  the  approach  must  be  discontinued  if  the 
aircraft  is  still  in  cloud  when  the  localiser  becomes  unusable.  The 
situation  display,  giving  a  continuous  picture  of  where  the  aircraft 
is  relative  to  its  manoeuvre  limits  on  locallser,  will  certainly  be 
of  great  value  to  the  pilot  in  this  situation. 

Aircraft  provisions 

Provision  for  fitment  of  this  stage,  built  into  the  aircraft  can  be 
offered  at  two  levels:  - 

h)  Basic  provision  for  autoflare  consists  of  certain  redesigned 
elements  such  as  structure  around  radio  altimeter  aerial 
holes,  provision  for  automatic  throttle,  etc.,  and  is  in¬ 
tended  for  operators  whose  probable  intention  is  to  incorpor¬ 
ate  autoflare  when  it  becomes  available  and  who  wish  to  reduce 
the  out  of  service  time  for  installation 

b)  Full  provision  for  autoflare  includes  all  structural  and  mechanical 
elements  necessary  for  rapid  fitment  of  autoflare  when  available. 
This  provision  reduces  the  out  of  service  time  for  autoflare 
installation  to  a  miniaum. 

N.B.  These  provisions,  of  course,  only  apply  to  customers  who  will  take 
delivery  before  autoflare  has  con^leted  its  development  and  certification. 

The  full  automatic  flareout  control  system  is  the  subject  of  the  present 
firm  development  prograame  being  Jointly  undertaken  by  BAG  and  Elliotts 
with  Bendix  support.  The  system,  as  in  the  case  of  the  VCIO,  is  based 
on  the  B.L.B.U.  exponential  flare  law  and  as  such  does  not  utilise  a 
glide  slope  extension  scheaie,  but  does  include  an  attitude  hold  phase. 

This  however,  should  be  extreaiely  short,  as  current  developamnts  in 
ground  aids  to  I.C.A.O.  Cat.  II  and  III  should  enable  glide  slope 
coupling  to  be  maintained  to  much  lower  altitudes.  Similarly  with  the 
higher  performance  of  the  newer  airborne  equipment  and  improvements  in 
failure  warnings  to  be  utilised  in  this  system,  it  may  well  be  possible 
to  achieve  coupling  to  lower  altitudes  on  some  Cat.  I  I.L.S.  systems. 
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The  automatic  flare  out  system  utilises  a  self  monitored  radio  altimeter 
STR  51  developed  for  the  VCIO  system  by  Standard  Telephone  &  Cables  Ltd. 

It  employs  proven  design  techniques  and  components  from  other  S.T.C. 
altimeters  such  as  those  used  in  B.L.E.U.  systems,  the  altimeters  used 
in  the  F.A.A.  DC-7  aircraft  etc.  The  altimeters  give  warning  of  passive, 
active,  and  "mal- performance"  failures  which  Is  utilised  to  disconnect 
the  system  In  use  and  for  automatic  changeover  to  the  second  automatic 
control  system.  This  Is  done  In  the  case  of  other  system  failure  Indica¬ 
tions  such  as  automatic  pilot,  glide  slope  receivers  etc.  There  Is  one 
other  aspect  of  this  form  of  system  which  should  be  mentioned.  The 
diagrams  refer  to  monitored  glide  slope  receivers.  Similarly  a  schematic 
of  a  full  automatic  landing  system  of  this  type  would  refer  to  monitored 
locallser  receivers.  The  term  'monitored*  In  this  case  means  that  the 
unit  In  question  shall  be  capable  of  giving  a  warning  of  Its  own  failure, 
that  Is  failure  to  operate  and,  to  as  great  a  degree  as  possible,  failure 
to  function  correctly.  A  glide  slope  receiver  has  been  developed  by 
Messrs.  Marconi  for  the  VClO  system,  which  provides  such  a  warning,  as 
does  the  S.T.C.  radio  altimeter.  The  technique  does  not  necessarily 
mean  a  greatly  complicated  design.  Indeed  In  the  case  of  the  glide 
slope  receiver  the  solution  Is  extremely  simple. 

Discussions  are  In  progress  with  other  radio  manufacturers  as  to  how 
the  present  receivers  to  the  latest  A.R.I.N.C.  characteristic  stand 
with  respect  to  the  requlresient  above,  and  what  changes  are  necessary. 

It  Is  emphasised  that  such  an  improved  twarning  arrangement  has  general 
application  apart  from  lower  minima  operation,  providing  the~pllot  with 
absolute  Indication  of  a  unit's  failure. 

Sumnarlslng  the  autoflare  concept  described  above,  it  can  be  said  that 
BAC  regard  this  system  as  a  safe  means  of  achieving  the  I.A.T.A.  Phase  II 
aims,  which  also  contains  the  development  potential  for  extension  further 
to  a  Phase  III  full  all  weather  landing  system. 

Stage  7 

Automatic  landing.  Additions  to  (6)  which  would  be  necessary  to  achieve 
full  automatic  landing  would  probably  consist  of  a  further  monitored 
azisuth  channel,  two  azlsuth  landing  computers  to  generate  the  runwey 
alignment  commands,  monitoring  elements  to  locallser  receivers  and  possibly 
some  iBodiflcatlons  to  the  situation  display  Instruamnts.  Such  a  system 
would  be  capable  of  eliminating  any  cloud  base  restriction,  but  msy  still 
be  subject  to  a  significant  restriction  on  R.V.R.  because  of  the  roll¬ 
out  problem.  The  capability  of  the  situation  display  Instniment  in  this 
role  has  yet  to  be  established.  Some  modification  to  the  situation  dis¬ 
play  or  an  alternative  Instrument  may  well  be  required  to  cover  the  roll¬ 
out  phase. 

As  an  intermediate  stage  between  full  autoflare  (6)  and  full  automatic 
landing  (7) ,  some  consideration  is  being  given  to  the  possibility  of 
supplying  the  pilot  with  azimuth  director  coornmnds  during  the  final 
phase  of  the  approach. 
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Such  a  system  might  consist  o£  full  autoflare  (6)  plus  azimuth  landing 
computers,  locallser  receiver  monitoring  elements  and  some  form  of  head 
up  azimuth  director  Instrument  -  perhaps  added  to  the  situation  display. 
The  need  to  Install  a  complete  additional  monitored  azimuth  control 
channel  would  be  avoided. 

4.  EXPECTATION  OF  LOWER  MINIMA  FROM  THE  VARIOUS  ALTERNATIVES 

A  feel  for  the  potentialities  of  each  alternative  system  described  can 
perhaps  best  be  obtained  by  first  considering  all  the  barriers  to  the 
use  of  lower  minima  that  presently  exist  and  deciding  how  many  barriers 
can  be  eliminated  by  each  possible  sysl^em.  The  potentialities  of  each 
of  the  systems  described  in  Section  3  is  summarised  in  Table  I. 

CONaUDING  REMARKS 


Development  of  bad  weather  landing  systems  on  the  BAC  One-Eleven  is  currently 
In  progress. 

A  specific  project,  which  is  quite  firm,  is  the  development  and  certification 
of  a  safe  autoflare  system  employing  redundancy  of  systems  in  pitch  and 
"fail  soft"  techniques  in  azimuth,  and  using  the  basic  B.L.E.U.  manoeuvre. 

This  system  will  be  flight  tested  by  BAC  during  1965  and  offered  for  air¬ 
line  use  In  1966.  In  addition,  the  potentialities  of  systems  both  less 
and  more  extensive  than  this  autoflare  system  are  being  explored,  so  that 
a  flexible  approach  can  be  made  to  the  potential  operators  of  the  aircraft. 

BAC  is  convinced  that  the  basic  principles  of  the  B.L.E.U.  radio  altimeter 
controlled  exponential  flare  form  a  satisfactory  basis  for  an  all  weather 
system.  It  Is  also  convinced  that  a  safety  standard  demonstrably  as  high 
and  preferably  higher  than  at  present  being  achieved  in  low  minima  landings 
must  be  a  prime  consideration  In  the  system  designs.  In  considering  the 
safety  Issue,  however,  It  does  not  exclude  the  possibility  that  some  benefit 
Is  obtainable  In  terms  of  lowered  minima  with  systems  which  are  not  fully 
failure  survival  on  automatics. 

The  chart  given  In  Table  1  seeks  to  denx>nstrate  that  some  obstacles  to 
progress  can  be  removed  with,  for  example,  a  completely  "fall  soft"  system. 

The  difficulty  lies  In  determining  Just  what  the  return  Is  for  each  additional 
Item  added  to  the  system,  and  where  to  stop.  This  Is  only  likely  to  be  fully 
resolved  after  sosie  In-service  experience  has  been  obtained  on  the  first 
systems.  The  flexibility  being  designed  into  the  BAC  One-Eleven  systems 
should  enable  It  to  provide  economical  and  practical  solutions  for  most 
operational  envlronsients. 
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1.  nJTROEUCTION 


Smiths  Aviation  Division  has  been  active  in  the  all  weather  operations 
field  since  its  first  association  with  the  Blind  Landing  Experimental 
Unit  of  R.A.E.  in  its  autolanding  programme.  The  BLEU  programme  has 
been  carried  out  using  Staiths  automatic  pilots  and  associated  systems, 
while  the  experience  thus  gained  has  been  of  great  value  in  shaping 
the  design  of  future  Smiths  eq,uipment. 

In  the  mid  1950s,  Smiths  electric  automatic  pilots  of  the  SEP. 2  series 
were  in  general  service  in  a  variety  of  transport  aircraft.  The 
company  was  also  active  in  the  fli^t  instrument  system  field,  and 
the  Smiths  FLi^t  System  was  in  service  with  a  number  of  airlines.  At 
the  same  time,  a  military  autopilot  from  which  many  of  the  features 
of  SEP. 2  had  been  derived,  was  in  production  and  destined  for  service 
with  the  R.A.  F,  V-Bomber  force.  It  was  against  this  background  that 
the  canpany  decided  to  carry  out  a  broad  programme  of  research  and 
development  aimed  at  producing  a  new  generation  of  autopilots  and 
fli^t  control  systems  suitable  for  all  weather  operation. 

In  1957,  a  feasibility  study  led  to  the  decisions  to  go  for  the  develop¬ 
ment  of  a  Multiplex  automatic  pilot.  This  conception  has  been  described 
in  greater  detail  elsewhere.  Such  a  system  can  be  used  in  the  duplex 
form  to  provide  a  fall-soft  characteristic,  and  in  the  triplex  form 
to  provide  an  autopilot  which  will  survive  a  single  failure.  The 
feasibility  study  also  led  to  certain  decisions  as  to  the  scope  of  the 
operational  features  to  be  provided  in  an  autopilot  for  the  new  gener¬ 
ation  of  Jet  transports. 

At  this  time,  the  SEP. 2  was  capable  of  flying  Jet  aircraft,  and  the 
application  to  the  Comet  had  confirmed  this  fact.  Nevertheless,  it 
was  felt  that  the  engineering  implications  of  accepting  the  Multiplex 
principle  were  such  as  to  make  it  desirable  to  develop  a  completely  new 
system. 

An  experimental  version  of  the  new  autopilot  was  built  and  a  triplex 
pitch  channel  was  subjected  to  a  series  of  flight  trials  in  a  DC-3 
belonging  to  the  company's  flying  unit.  This  confirmed  the  feasibility 
of  the  Multiplex  approach.  At  the  same  time,  further  development  in 
conjunction  with  BLEU  was  resulting  in  a  single  channel  autcmatic  pilot 
capable  of  autolanding,  together  with  an  efficient  automatic  throttle 
control  system. 

Towards  the  end  of  1958,  British  European  Airways  decided  that  the 
Trident  Jet  transports  under  development  by  de  Havillands  should 
ultimately  be  equipped  for  all-weather  operation.  My  company  was  asked 
to  undertake  the  development  of  a  suitable  system.  It  was  felt  that 
such  an  all-weather  system  should  have  the  following  characteristics 
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1.  The  automatic  pilot,  flight  instrument  system,  automatic 
throttle  control  and  hasic  flight  instrumentation  should 
all  be  integrated  as  a  complete  operational  package. 

2.  In  order  to  simplify  the  maintenance  of  this  complex  range 
of  equipment,  all  the  various  systems  would  be  developed 
in  parallel  using  standard  components  and  sub-assemblies 
where  possible. 

3.  The  safety  studies  inseparable  from  the  development  of 
this  sort  of  systems  would  be  extended  to  cover  the 
complete  package  together  with  the  aircraft  power  system 
and  flying  controls. 

k.  New  procedures  for  line  maintenance  and  trouble  shooting 
would  be  developed  on  a  system  basis  with  the  aim  of 
facilitating  trouble  shooting  within  an  aircraft  turn 
round  time  of  30  minutes. 

The  development  of  this  system  was  undertaken  by  Staiths  Aviation 
Division  as  a  ixrivate  venture.  However,  it  was  apparent  that  a 
similar  system  would  have  wide  application  with  Transport  Command 
of  the  Royal  Air  Force,  and  for  this  reason  the  British  Ministry  of 
Aviation  awarded  a  contract  for  the  development  of  a  similar  military 
system. 

It  was  decided  to  base  the  military  system  on  that  alread.y  under 
development  for  the  civil  application.  It  was  also  decided  that 
this  Government  sponsored  programme  would  include  flight  trials  in 
two  aircraft  which  would  be  specially  converted  as  flight  test 
vehicles.  Finally,  it  was  decided  that  the  first  specific  application 
of  the  military  system  would  be  to  the  Short  Belfast  long  reinge 
freighter  at  present  under  development  for  the  R,A,F,  Tills  led  to  a 
subsidiary  programme  for  the  development  of  certain  special  navigation 
facilities  for  this  aircraft. 

Fli^t  development  work  on  earlier  generations  of  Stoiths  autopilots 
and  flight  systems  iiad  been  carried  out  in  a  variety  of  aircretft.  The 
SEP.  2  and  SFS  development  was  carried  out  in  em  Anson  whilst  the  further 
development  of  military  variants  of  the  SEP.  2  was  undertaken  in  a  DC- 3. 
Subsequently,  Varsity  G-APAZ  was  provided  by  the  Ministry  of  Supply  as 
a  fli^t  development  aircraft  for  the  "First  Generation"  automatic 
landing  system  now  in  use  in  the  Royal  Air  Force. 

The  Varsity  had  piroved  itself  a  reliable  aircraft,  and  eminently  suitable 
for  this  purp>ose.  It  has  the  nose  wheel  landing  gear  necessary  for  an 
automatic  landing  programme.  The  apparent  limitations  of  low  approach 
and  landing  speeds,  piston  engines  etc.  can  really  be  considered  adran- 
tages  in  the  early  stages  of  system  development.  The  aircraft  is 
reliable,  has  no  vices  and  its  handling  by  the  pilot  is  straig^itforward. 
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This  means  that  for  work  close  to  the  ground,  the  flight  crew  are 
thoroughly  familiar  with  the  characteristics  of  the  aircraft  and 
can  devote  their  attention  to  the  flight  control  system  and  its 
development  problems.  Accordingly,  a  second  Varsity,  G-ARPP,  was 
allocated  by  the  Ministry  of  Aviation  for  the  development  of  the 
new  system. 

The  other  aircraft  allocated  for  the  development  programme  was  a 
Comet  HE,  G-AMXK.  This  aircraft  had  previously  been  used  by 
B.O.A,C.  for  route  familiarisation  and  for  the  proving  of  Avon 
engines  parior  to  the  introduction  into  service  of  the  Comet  14-. 
Although  the  Varsity  was  obviously  the  less  expensive  vehicle 
in  which  to  carry  out  a  large  number  of  automatic  landings,  the 
Comet  was  ideal  for  the  evaluation  of  performance  in  the  high 
speed,  hi^  altitude  operating  regimes.  It  was  also,  suitable  for 
investigating  the  handling  of  the  system  in  low  weather  minima  in 
conjunction  with  other  operational  problems  characteristic  of  the 
jet. 

The  Varsity  conversion  was  carried  out  by  the  Depeortment  of  Fli^t 
of  the  College  of  Aeronautics,  Cranfield.  The  conversion  was 
completed  in  time  for  the  aircraft  to  fly  in  the  late  summer  of 
1962.  The  Comet  conversion  was  carried  out  in  a  series  of  stages 
by  the  de  Havilland  Aircraft  Company,  and  flying  began  in  i960. 

Phase  I  was  an  investigation  of  the  high  speed,  high  altitude 
performance  of  an  experimental  sing].e  channel  autopilot  using  the 
control  laws  which  were  to  be  used  ultimately  in  the  SEP,  5  multiplex 
system.  In  the  second  phase,  phase  lA,  the  aircraft  carried  a 
pre-production  multiplex  autopilot  with  duplex  pitch,  and  simplex 
roll  channels.  A  duplex  yaw  damper  channel  was  also  fitted.  This 
phase  cleared  the  basic  performance  of  the  multiplex  autopilot, 
althou^  no  attempt  was  made  to  extend  its  operation  to  automatic 
landing.  An  essential  feature  of  these  two  early  phases  was  that 
the  equlpnent  was  installed  in  the  aircraft  in  such  a  way  as  to 
minimise  the  amount  of  conversion  work  required.  In  a  later  part 
of  this  paper,  there  is  a  description  of  the  conversion  carried 
out  for  jtoise  2  of  the  operation,  involving  more  radical  modifi¬ 
cations  of  the  basic  aircraft,  radio  and  electrical  systems. 

Hie  work  carried  out  on  these  two  trials  aircraft  has  provided  a 
great  deal  of  information  on  the  problems  to  be  anticipated  when 
an  integrated  all-weather  system  is  fitted  retrospectively  to  a 
civil  alrcrfidrt.  Parallel  experience  of  ah  installation  designed 
from  its  inception  for  all-weather  operation  has  been  gained  with 
the  de  ^vllland  Trident,  in  which  a  production  system  has  now 
been  flying  for  over  a  year.  Finally,  design  studies  were  carried 
out  as  a  result  of  which  It  was  fouxid  possible  to  devise  means  of 
installing  the  equipment  in  a  Caravelle. 
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At  the  present  time,  the  Varisty  has  carried  out  Its  first  automatic 
landings  and  Is  now  ccnmltted  to  an  Intensive  flight  development 
programme.  The  Comet  conversion  for  x^ase  2  of  the  operation  has 
been  completed  and  the  aircraft  has  been  rolled  out.  The  Trident 
system  has  been  worked  up  to  a  point  at  which  approaches  are  being 
made  to  low  altitudes  using  the  automatics,  the  automatic  throttle 
control,  and  the  Bara-Vlsual  Director  system. 

2.  SCOPE  OF  THE  MULTIPLEX  FLIGHT  CONTROL  SYSTEM 

A  schematic  of  the  complete  fll^t  control  system  Is  shown  In  fig.  1. 
The  complete  system  consists  of  the  following  sub-systems. 

2.1  SEP. 3  Multiplex  Automatic  Pilot 

In  the  Varsity  this  system  consists  of  pitch  and  roll 
axes  which  can  be  operated  at  triplex  level,  with  a 
rudder  axis  at  duplex  level. 

In  the  Comet,  the  pitch  and  roll  channels  are  similar  to 
those  fitted  to  the  Varsity  but  the  rudder  channel  Is 
essentially  a  duplex  yaw  damper  system.  This  means  that 
In  normal  cruising  flight  under  either  manual  or  automatic 
control,  automatic  Inputs  to  the  rudder  circuit  are  Injected 
through  actuators  operating  In  series  with  the  rudder  pedals, 
which  do  not  move.  In  the  approach  and  landing  configuration 
sepeurate  servomotors  eure  clutched  In  to  provide  a  duplex 
rudder  channel  facility  with  the  high  authority  necessary 
to  remove  the  drift  during  an  automatic  landing. 

2.2  Attitude  System 

In  both  aircraft  three  vertical  gyro  references  are 
carried.  Two  are  used  to  feed  the  pilots  and  co-pllots 
attitude  displays,  the  third  being  used  to  feed  the  fll^t 
director  system. 

2. 3  Compass  System 

Both  aircraft  carry  twin  gyro  magnetic  compass  systems 
Integrated  with  the  situation  display  element  of  the 
flight  system. 

2.4  Air  Data  System 

Each  aircraft  Is  equipped  with  twin  air  data  computers. 

Apart  from  operating  the  basic  pilot's  manometrlc  Instru¬ 
ments,  these  eire  used  to  supply  a  variety  of  manometrlc 
Information  to  the  autopilot  and  fll^t  Instrument  system. 
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2. 5  Fll^t  Director  System 

One  feature  of  the  operational  requirement  is  that  it 
calls  for  a  flight  director  system  duplicating  all  the 
facilities  available  through  the  autcmatic  pilot. 
Ccmpensatory  type  director  bars  are  displayed  on  the 
attitude  indicators  and  the  director  functions  are 
selected  simultaneously  with  those  of  the  autopilot 
on  a  common  Flight  Controller. 

2.6  Autcmatic  Throttle  Control 

The  automatic  throttle  control  system  uses  airspeed 
signals  generated  by  the  twin  air  data  systems  in 
conjunction  with  pitch  rate  derived  from  the  autopilot. 
The  basic  system  is  familiar  to  those  with  knowledge 
of  the  FAA  DC-7  installation,  although  the  actual 
equipment  is  of  a  later  generation,  the  complete  system 
being  contained  in  a  ^  short  ATR  box. 

2.7  Operational  Facilities 


The  complete  system  provides  a  range  of  operational 
facilities  covering  all  phases  of  flight  up  to  and 
including  landing.  The  following  is  a  brief  summary 
of  the  facilities  available; - 

Autopilot  and  fli^t  director,  attitude,  I,A,S, 
Mach,  height  and  rate  of  descent  locks. 

Automatic  or  flight  director  acquisition  of  a 
pre-selected  cruising  altitude  following  a  climb 
or  descent  on  any  of  the  above  locks. 

Automatic  VOR,  Doppler  and  Tacan  coupling. 

Automatic  and  flight  director  ILS  approach  to  a 
low  altitude  including  autcmatic  control  of  the 
airspeed  throu^  the  throttles. 

Automatic  landing  including  both  flare  and  decrab 
elements,  with  the  ability  to  use  any  form  of  split 
axis  control  at  the  pilot's  option. 
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3.  A  REVIEW  OF  SOME  PRACTICAL  ENGINEERING  PROBLEMS 


3.1  System  Safety 


As  a  result  of  previous  experience  with  similar  projects,  it 
was  felt  that  a  very  clearly  defined  safety  philosophy  should 
he  formulated  at  an  early  stage  in  the  project.  The  practical 
engineering  difficulties  of  Implementing  any  safety  philosophy 
are  considerable,  and  can  only  be  overcome  if  it  is  always 
possible  to  relate  specific  detailed  engineering  problems  to 
seme  overriding  operational  philosophy.  This  is  particularly 
so  where  redundancy  in  any  form  is  used  to  achieve  safety. 
Without  an  overall  systems  study  in  the  early  stages  of  the 
project,  it  is  possible  to  over  complicate  the  detailed  design 
in  ways  which  are  not  operationally  necessary. 

The  basic  conception  of  the  system  is  that  the  primary  means 
of  landing  the  aircraft  in  zero-zero  conditions  is  throu^ 
the  use  of  the  automatic  pilot.  The  triplex  pitch  and  roll 
channels  are  so  designed  that  failures  in  one  axis  will  not 
affect  the  other,  while  the  loss  of  a  single  sub -channel 
leads  to  an  automatic  reversion  to  the  duplex  mode  without 
risk  of  the  channel  cutting  out. 

Duplex  redundancy  only  is  used  in  the  rudder  channel,  where 
it  is  felt  that  an  autcmatic  disengagement  of  that  axis  is 
unlikely  to  hazard  the  aircraft,  provided  that  it  occurs 
passively. 

The  air  data  and  conpass  system,  both  of  which  provide  basic 
fli^t  information,  are  duplicated.  .  Here  the  safety  philosophy 
states  that  it  should  be  impossible  for  a  failure  in  one  system 
to  be  communicated  to  the  other,  while  pilot  warning  of  a 
failure  can  be  secured  by  comparing  the  outputs  of  the  two 
systems. 

The  function  of  the  flight  director  is  two-fold.  In  cruising 
flight,  certain  autopilot  functions  associated  with  locking 
to  heights,  airspeeds  etc,  are  not  duplicated,  and  a  single 
failure  can  lose  a  particular  facility.  However,  euLl  these 
locking  facilities  are  duplicated  in  the  fli^it  director 
system  which  is  thus  available  as  a  back  up  should  an  auto¬ 
pilot  facility  be  lost.  Accordingly  here  the  philosophy  is 
to  drive  the  autopilot  and  flight  director  systems  frem 
separate  systems  and  separate  power  supplies,  ensuring  that 
no  common  failure  can  affect  both  systems. 
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In  the  case  of  the  autcanatlc  throttle  control,  it  was  felt 
that  the  system  need  not  he  given  the  ability  to  survive  a 
failure.  Manual  operation  of  the  throttles  to  hold  the 
airspeed  is  feasible,  and  the  pilot  can  be  given  an  indication 
of  the  correct  height  at  which  to  close  the  throttles  durihg 
automatic  landing.  However,  it  is  important  that  a  hardover 
of  the  throttle  system  should  not  hazard  the  aircraft  by 
producing  a  large  airspeed  excursion,  particularly  at  low 
altitudes.  Accordingly,  the  auto- throttle  system  uses  two 
separate  airspeed  inputs  derived  from  the  air  data  computers 
together  with  a  pattern  of  redundancy  aimed  at  comparing 
throttle  positions  to  cut  the  system  out  in  the  event  of 
a  hardover.  It  has  been  found  feasible  to  limit  the  conse¬ 
quences  of  a  failure  of  the  integrator,  pitch  rate  or  flap 
position  terms,  and  these  are  not  duplicated. 

3.2  Fault  Analysis 

With  the  above  j^ilosophy  as  a  point  of  departure,  it  was 
decided  to  set  up  a  special  fault  analysis  team  within  the 
system  development  or ^ni sat ion.  The  procedure  adopted 
for  fault  analysis  was  described  in  a  recent  pap)er  submitted 
to  the  I.A.T,A.  Conference  at  Lucerne.  Broadly  speaking  it 
consists  of  surveying  the  whole  system  and  determining  areas 
within  which  it  is  vulnerable  to  failures. 

One  example  of  a  vulnerable  area  arises  when  it  is  necessary 
to  use  more  than  one  of  the  system  power  supplies  within  a 
particular  electronic  unit.  The  complete  system  is  normally 
driven  frcm  three  separate  supplies.  The  design  is  such  that 
its  operation  is  not  affected  by  differences  of  phase,  fre¬ 
quency  or  volts  between  the  supplies  provided  that  they  remain 
within  normal  limitations.  However,  at  some  points  it  is 
necessary  to  bring  systems  together,  for  example  where  the 
sub-channels  of  a  multiplex  autopilot  are  equalised.  Under 
these  circumstances,  pjrop)er  isolation  must  be  preserved 
between  the  system  signal  circuits  themselves  and  the  separate 
power  supplies  if  these  are  also  required  within  the  one  unit. 
The  aim  of  the  fault  analysis  is  to  investigate  the  effect  of 
all  possible  failures,  for  example,  short  circuits  or  open 
circuits,  and  to  determine  where  special  circuit  segregation 
measures  are  necessary  within  units.  It  has  been  found 
necessary  to  make  this  a  continuous  activity,  with  the  results 
of  the  fault  analysis  being  fed  into  the  detailed  design  of  the 
hardware,  the  test  procedures,  and  ultimately  the  overhaul 
requirements . 

Fig.  2  shows  peurt  of  a  typical  electronic  assembly.  The  design 
is  such  that  segregation  is  maintained  between  two  circuits  as 
a  result  of  the  fault  analysis  requirement. 
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3. 3  Aircraft  Installation  Requirements 


It  has  been  shown  that  the  fll^t  control  system  Itself  has 
been  designed  to  very  high  standards  of  safety  and  reliability. 
However,  the  system  cannot  by.  Itself  give  a  particular  aircraft 
the  necessary  standard  of  safety  required  for  automatic  landing. 
All  other  aircraft  systems  which  are  directly  concerned  with 
controlled  flight  of  the  aircraft  must  be  designed  to  similar 
standards.  This  Includes  powered  flying  controls,  engine 
controls  etc. 

Some  account  must  also  be  tsiken  of  other  systems  (e.  g. 
electrical  generation  and  distribution)  which,  although  not 
directly  connected  to  the  aircraft  controls  would  result  In 
a  catastrophic  failure  of  the  aircraft  If  a  fault  developed 
and  had  repercussions  In  the  other  vital  systems.  These 
considerations  are  now  routine  In  the  design  of  a  new  aircraft 
but  to  apply  them  retrospectively  to  present  day  standards  to 
the  trials  aircraft  presented  many  problems.  It  was  decided 
that  scane  effort  had  to  be  made  to  do  this  In  the  Interests 
of  proving  the  ccmplete  system  philosophy  and  In  order  to 
secure  a  high  standard  of  safety  In  aircraft  which  would  be 
operated  In  zero-zero  conditions. 

A  requirement  for  the  Veurslty  was  that  the  aircraft  should 
not  exceed  a  sxjeclflc  maximum  all  up  weight  required  for 
operation  from  the  short  runways  at  the  company's  heme 
airfield  at  Staverton.  This  figure  was  below  the  maximum 
all  up  weight  for  the  aircraft.  The  minimum  operating  crew 
was  to  be  two  pilots  and  thus  the  management  of  all  systems 
had  to  be  possible  from  either  the  first  or  second  pilot's 
positions.  In  this  aircraft  the  blggett  problon  was  that  of 
providing  an  electrical  system  to  a  standard  compeurable  with 
that  of  the  fll^t  control  system.  The  assumption  was  that 
a  complete  loss  of  electrical  power  In  the  aircraft  could 
cause  disaster  If  It  occurred  In  close  proximity  to  the 
ground  while  carrying  out  an  automatic  landing  in  zero-zero 
conditions.  In  addition,  it  was  required  that  no  single 
fault  condition  could  cause  the  loss  of  more  than  one  power 
supply  to  the  fli^t  control  system.  The  aircraft  conversion 
was  to  be  to  the  satisfaction  of  the  Air  Registration  Board 
and  a  Certificate  of  Airworthiness  in  the  Special  Category 
was  required  to  enable  its  operation  as  a  civil  aircraft  by 
the  company's  flying  unit. 

It  was  decided  that  the  electrical  and  radio  systems  In  the 
Comet  would  have  to  be  completely  rewired  using  the  segregation 
principles  accepted  for  the  flight  control  system.  Three 
completely  segregated  electrical  generating  and  distribution 
systems  were  to  be  provided. 
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The  Comet  radio  installation  to  the  original  B,O.A.C. 
standard  was  Inadequate  for  all-weather  operation.  The 
final  radio  installation  represents  a  combination  of  the 
all-weather  requirement  and  of  certain  particular  operational 
requirements  involving  the  use  of  both  civil  and  military 
airfields.  The  complete  installation  comprises  the  following: - 

3  VHP  Communication  Transraitter/Receivers 

1  UHP  Communication  Transmitter/Receivers 

2  HF  Communication  Transmitter/Rec elvers 

2  ADP  Receivers 

2  ILS/VOR  Navigation  Receivers 

3  Leader  Cable  Receivers 

3  Radio  Altimeters 

2  Marker  Receivers 

1  Doppler  Installation 

1  Tacan  Receiver 

1  Weather  Radar 

The  Leader  Cable,  UHP,  Doppler  and  Tacan  installations  reflect 
the  requirement  to  operate  through  military  airfields  and  the 
needs  of  a  special  navigation  system. 

The  Varsity  flying  controls  are  conventional,  the  surfaces  being 
operated  by  direct  manual  control.  The  integration  of  the  auto¬ 
pilot  with  the  flying  controls  was  along  the  lines  suitable  for 
general  retrofit  to  present  day  aircraft. 

In  each  axis  of  control  a  special  servomotor  mounting  is  provided 
to  which  can  be  attached  up  to  three  completely  self  contained 
servomotors,  each  driven  from  a  separate  sub-channel.  Included 
in  each  servomotor  is  an  electro-magnetic  clutch  and  a  torque 
limiter.  In  the  event  of  a  handover  developing  in  one  sub-channel 
of  the  system,  that  peurticular  servcmotor  develops  a  high  output 
torque  which  is  opposed  and  held  by  the  two  remaining  servomotors 
until  it  reaches  a  pre-determined  value.  At  this  value  the  torque 
limiter  switch  in  the  servomotor  assembly  operates  to  disengage 
the  faulty  sub -channel. 

Bach  sub-channel  in  the  systan  is  capable  of  flying  the  aircraft 
unaided.  This  is  an  intrinsic  feature  of  the  multiplex  system 
but  also  permits  the  autopilot  to  be  used  in  an  emergency  single 
channel  reversionary  mode  following  failures,  with  conventional 
protection  against  a  handover. 

The  consequence  of  this  requirement  is  that  each  individual 
servomotor  can  develop  sufficient  torque  to  fly  the  aircreift,  the 
maximum  torque  potential  of  the  system  being  thus  three  times  that 
required  for  adequate  control.  In  order  to  guard  against  the 
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possibility  of  the  autopilot  overstressing  the  control  runs, 
a  torque  authority  limitation  device  is  provided  within  the 
servomotor  moxmting.  This  provides  three  segregated  outputs 
which  limit  the  torque  imposed  by  the  three  servo  sub-channels. 
This  authority  limiter  is  also  used  to  provide  conventional 
protection  against  a  handover  when  an  axis  of  control  is  used 
at  simplex  ^r  single  channel  level.  The  triplex  servomotor 
assembly  is  shown  in  fig.  3. 

Althou^  the  Ccciet  is  equipped  with  fully  powered  controls, 
no  effort  was  made  to  integrate  the  autopilot  actuators 
with  the  hydraulics.  This  is  also  true  of  the  Hawker  Siddeley 
Trident,  where  it  has  been  found  possible  to  achieve  the 
necessary  standard  of  autopilot  performance  using  a  conventional 
servo  arrangement.  The  servomotor  installation  is  therefore 
similar  to  that  on  the  Varsity,  although  control  surface  limit 
switches  and  'g'  switches  are  used  in  the  emergency  single 
channel  reversionary  mode.  In  practice,  this  mode  of  operation 
is  a  useful  answer  to  the  problem  of  maintaining  a  system  which 
includes  redundancy.  The  operator  can  if  necessary  operate  the 
aircraft  “under  automatic  control  following  failures,  arranging 
to  carry  out  remedial  action  at  a  main  base. 

h.  VARSITY  INSTALLATION 

Pig.  4  shows  this  aircraft.  In  its  original  form  it  was  fitted  with 
ventral  blister  for  its  role  as  a  navigation  trainer.  This  was 
removed  in  the  interests  of  weight  saving.  A  dual  bredcing  system 
incorporating  Maxaret  control  was  installed.  The  interior  was 
completely  remodelled  and  the  racks  shown  in  fig.  5  were  installed 
to  take  the  electronic  equipment. 

A  special  station  for  a  flight  test  engineer  was  installed  in  the 
position  normally  occupied  by  the  jump  seat  in  a  civil  aircraft. 
Seating  for  five  other  persons  is  provided  in  the  nose  of  the  air¬ 
craft  in  order  to  allow  the  system  to  be  demonstrated. 

The  existing  Instrument  panels  were  removed  and  a  completely  new 
one  piece  panel  designed  and  fitted.  Hiis  is  shown  in  fig.  6. 

Pig.  7  shows  five  completely  new  cockpit  roof  panels  which  were 
fitted,  that  in  the  centre  containing  the  switches  and  Indicators 
for  the  management  of  the  electrical  system.  Ihe  radio  controllers 
are  fitted  in  the  roof  and  the  panel  immediately  above  the  windscreen 
holds  the  propellor  controls.  The  port  panel  contains  engine  starting 
and  airframe  de-icing  controls,  that  on  the  starboard  side  carrying 
some  of  the  engine  services. 
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Following  the  practice  in  the  Hawker  Slddeley  Trident,  all  the 
basic  aircraft  system  warnings  relating  to  engines,  fuel,  de-icing 
etc.  were  rationalised  and  incorporated  together  with  the  electrical 
and  fll^t  control  system  warnings  in  a  ccxnprehenslve  centralised 
warning  panel.  This  is  a  two  stage  red  and  amber  system  with 
flashing  li^ts.  The  warning  display  panel  is  in  the  centre  of 
the  cockpit  glare  shield. 

The  triplex  fli^t  control  system  requires  three  separate  sources 
of  a.c.  power.  The  basic  generation  system  on  the  aircraft  was  a 
28  volt  d.c.  system.  A  new  power  system  was  designed  and  rig 
tested  to  prove  that  single  faults  on  the  d.c,  system  would  have 
no  unacceptable  secondary  effects  on  the  three  a.c.  supplies. 

The  basic  d.c.  power  is  obtained  fran  four  engine  driven  generators 
giving  a  total  generator  capacity  of  24  kilowatts,  double  the  output 
of  the  original  Varsity  installation.  Four  2. 5  Invertors  are 
installed  and  these  give  ample  power  to  cope  with  any  future  Increases 
in  demand.  Experience  has  shown  that  this  is  a  characteristic  of 
research  aircraft  on  which  additional  flig^it  test  instrumentation 
may  be  required  or  new  experimental  systems  installed. 

Fig.  8  shows  the  distribution  system  including  the  busbeu:  boxes, 
circuit  brakers,  contracters  and  relays.  The  various  illustrations 
show  the  way  in  which  the  aircraft  cables  are  ceurried  in  ducts. 
Separate  ducting  is  used  for  the  three  separate  power  systems  and 
the  separate  elements  of  the  fli^t  control  system.  In  the 
illustrations  the  covers  over  the  ducts  have  been  removed  to  make 
this  segregation  visible.  Fig.  9  shows  the  fli^t  test  engineers 
station  including  the  flight  systems  panel  which  is  used  in  the  air 
to  check  that  all  the  available  system  redundancy  is  functioning. 

It  is  also  used  for  certain  ground  checks  and  to  enable  the  crew  to 
select  a  lower  level  of  autopilot  redundancy  should  they  desire  to. 

The  system  is  capable  of  operating  from  either  localiser  or  leader 
cable  guidance  and  the  controls  of  the  latter  are  included  at  the 
engineers  station.  At  least  505^  of  the  racking  area  in  the  cabin 
is  occupied  by  flight  test  instrumentation.  Means  are  provided  to 
vary  a  leurge  number  of  parameters  in  the  various  systems,  these 
normally  being  set  to  optimum  values  by  parameter  boxes  plugged  into 
the  front  faces  of  the  ATR  racked  units.  The  raci^ing  also  carries 
trace  recorders  and  the  other  recording  equipment  referred  to  later 
in  this  paper. 

5.  COMET  INSTALLATION 

For  the  first  two  phases  of  the  Comet  trials,  the  existing  aircraft 
fli^t  system  electrical  and  radio  installations  were  retained.  The 
subsequent  phase,  phase  2,  includes  trials  of  a  Multiplex  autopilot 
together  with  the  other  associated  systems  described  earlier  in  this 
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paper.  It  was  decided  to  engineer  the  ccmplete  installation  to  permit 
automatic  landings  to  be  carried  out  in  genuine  bad  weather  conditions 
with  a  high  level  of  safety  and  reliability.  The  conversion  work  for 
this  purpose  was  spread  over  a  period  of  twelve  months. 

The  aircraft  had  earlier  been  used  for  engine  development  work,  and 
two  different  types  of  engines  are  installed.  The  outboard  engines 
are  Avon  RA29s,  the  subject  of  the  original  trials.  The  inner 
engines  are  the  earlier  Avon  RA9  engines.  It  was  found  that  larger 
alternators  could  be  fitted  to  the  RA29  than  to  the  RA9  engine, 
and  each  of  the  outer  engines  can  also  provide  400  amps  of  rectified 
28  volt  d. c.  200  amps  is  available  frcM  each  of  the  alternators 
fitted  to  the  inners.  It  was  possible  to  use  these  facilities  to 
provide  three  basic  generating  systems,  each  capable  of  giving  i»-00 
amps. 

The  alternators  on  the  inner  engines  feed  a  canmon  busbar  through 
transfoimer/rectifier  units.  This  is  termed  the  WHITE  system. 
Connected  to  this  busbar  are  the  main  aircraft  batteries  and  an 
emergency  busbar  which  can  be  isolated  and  supported  by  batteries 
in  the  event  of  the  rest  of  this  WHITE  generating  system  failing. 

The  emergency  busbar  is  used  to  feed  fire  warning  circuits, 
emergency  hydraulic  pumps  etc. 

The  port  outer  engine  supplies  a  second  d.c.  power  system,  designated 
the  BLUE  system.  The  starboard  outer  supplies  a  third  YELLOW 
electrical  system.  The  three  systems  are  completely  segregated  and 
individually  regulated.  There  are  no  paralleling  or  eq.ualieing 
connections.  Thus  a  single  fault  condition  in  one  system  cannot 
have  a  reflected  effect  on  the  other  two.  This  is  Important  in 
the  event  of,  say,  a  major  earth  fault.  Under  these  conditions 
transients  imposed  on  healthy  parts  of  the  system  can  exceed  those 
normally  anticipated,  both  in  magnitude  and  duration  as  pjrotective 
devices  may  take  a  relatively  long  time  to  clear.  This  is  a  result 
of  the  need  to  provide  adequate  system  stability  to  cope  with  normal 
switching  transients  etc. 

A.C,  supplies  for  the  fli^t  control  system  are  derived  from  three 
separate  3  hva  invertors.  One  machine  is  supplied  from  each  of  the 
BLUE,  YELLOW,  and  WHITE  28  volt  d.c.  busbars.  The  invertor  outputs 
are  II5  volt  3  phase  3  wire  at  400  c.p. s.  The  aircraft  for  which 
the  new  fll^t  control  system  has  been  designed  have  200  volt  3  idiase 
U  wire  a.c.  generating  systems,  and  transformers,  are  provided  to 
produce  this  supply.  As  a  result  of  the  above  arrangement,  it  is 
possible  to  use  airborne  equipments  operating  on  either  11^  volt  or 
200  volt  a.c.  supplies,  a  useful  asset  in  a  development  aircraft 
which  may  have  to  accept  a  variety  of  equipments. 
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Reference  has  already  been  made  (see  Section  3.3)  to  the  scale  of 
radio  carried  in  this  aircraft.  Fig.  10  shows  part  of  the  aerial 
installation. 

The  cockpit  space  in  the  Conet  is  limited,  particularly  behind  the 
instrument  panels.  Nevertheless  it  has  been  possible  to  make  a 
very  clean  installation  and  this  is  shown  in  fig.  11.  Fig.  12  is 
a  close  up  view  of  the  instrument  panels.  It  will  be  seen  that 
the  Fli^t  Controller  for  the  complete  system  is  mounted  vertically 
in  the  centre  of  the  panel.  This  is  not  standard  practice,  the 
unit  having  been  designed  to  be  built  into  a  centre  console  between 
the  two  pilots.  By  mounting  the  unit  in  the  manner  shown,  it  is 
possible  to  avoid  anything  but  minor  modifications  to  the  throttle 
pedestal  and  its  controls.  The  cut-out  buttons  for  the  automatic 
throttle  control  system  can  be  seen  on  the  outboard  sides  of  the 
outer  throttle  levers.  The  three  indicators  above  the  FLi^t 
Controller  are  Lending  Indicators,  displaying  the  outputs  from  the 
three  Radio  Altimeters.  Information  on  flight  system  failure  is 
conveyed  to  the  pilot  through  the  indicator  panels  mounted  above 
the  horizon  displays. 

The  crew  stations  on  the  left  of  the  flight  deck  are  designed  to 
be  occupied  by  the  fli^t  trials  engineer  controlling  the  test 
instrumentation  and  a  second  fli^t  trials  engineer  or  a  navigator. 

FLg.  13  shows  the  main  cabin.  The  electronic  equipment  is  carried 
in  three  racks  with  all  the  interconnections  brought  out  in 
Junction  boxes.  This  has  been  found  a  useful  feature  in  other 
research  aircraft  in  which  it  is  often  necessary  to  make  rapid 
system  modifications  or  to  connect  up  for  special  instrumentation 
requirements.  Fig.  lU  shows  the  Instrumentation  console  from 
which  all  the  recording  facilities  can  be  controlled  by  a  fll^t 
trials  engineer. 

6.  FLIGHT  TRIALS  INSTRUMENTATION 


It  has  been  found  necesseury  to  design  a  range  of  equipment  specially 
suited  to  the  requirements  of  a  flight  control  system  development 
programme.  Riotograpiilc  trace  records  have  been  found  best  for 
this  type  of  work  and  suitable  recorders  and  galvanometers  are 
easily  available.  It  is  however,  necessary  to  provide  equipment 
to  convert  a  wide  variety  of  electrical  signals,  both  a.c.  and 
d.c.  to  a  form  suitable  for  feeding  the  galvanometers.  As  well  as 
the  usual  problems  associated  with  correct  sensitivity  levels, 
demodulation,  amplification  and  loading,  the  integrity  of  the 
flight  control  system  has  to  be  preserved  when  signals  Internal  to 
it  sire  brou^t  out  for  recording  purposes.  Thus  it  has  been 
necesscury  to  maintain  the  segregation  standards  in  this  instrumentation. 
As  four  Invertors  are  used  in  the  aircraft,  it  is  necessary  to  provide 
for  the  possible  use  of  2k  pdiase  references  for  demodulation  purposes. 
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In  order  to  enable  maxlmuin  utilisation  of  flying  time  to  be  made, 
it  is  a  requirement  that  it  be  possible  to  cater  for  different 
tests  during  one  flight.  Obviously,  the  changes  associated  with 
a  change  in  tests  have  to  be  kept  to  a  minimum  and  must  be  capable 
of  being  carried  out  quickly  by  the  operation  of  switches.  It  is 
also  desirable  to  be  able  to  revert  to  any  particular  instrumentation 
set  up  without  laborious  re-calibration. 

The  standard  equipment  includes  three  types  of  input  unit  (hig^ 
and  low  Impedance  d. c.  and  a.c. )  to  process  the  signals  to  be 
recorded  and  a  unit  (power  pack  and  calibration  unit)  to  provide 
the  necessary  electrical  supplies  and  calibration  voltages.  Tlie 
complete  instrumentation  system  is  sub-divided  into  a  relatively 
large  number  of  units  or  modules  and  the  method  of  Interconnection 
used  gives  great  flexibility.  The  system  can  record  signals 
originating  from  the  fli^t  control  system,  aircraft  control  surface 
position  pick-offs,  or  sensors  used  to  detect  the  aircraft  actual 
behaviour.  These  may  include  independent  gyros,  airspeed  sensors 
etc.  if  required. 

Two  photographic  trace  recorders  are  used,  each  of  which  is  fitted 
with  25  recording  galvanometers.  In  addition,  two  signal  units 
giving  blip  indications  and  two  datum  units  are  fitted.  Time 
indication  is  given  by  printing  full  width  lines  on  the  6"  recording 
paper. 

A  central  time  control  unit  has  been  designed  to  give  a  wide  range 
of  timing  pulses  for  simultaneous  use  in  both  recorders.  Pulses 
at  minute  intervals  are  used  to  operate  synchronised  counters 
which  print  numbers  on  the  trace  records  whilst  a  similar  counter 
repeats  the  information  at  the  control  panel  at  the  flight  test 
engineer's  station. 

A  two  track  tape  recorder  is  provided  on  which  normal  intercomm 
conversations  can  be  recorded.  The  second  track  is  available  for 
independent  use  by  the  flight  test  engineer. 

Ihe  above  description  relates  primarily  to  the  recording  Instedlatlon 
in  the  Varisty.  However,  the  Comet  Installation  is  somewhat  similar 
and  the  same  basic  modules  are  used  in  it.  This  has  simplified  the 
maintenance  of  the  recording  equipment.  Similar  recording  techniques 
are  used  in  other  aircraft  involved  in  the  development  of  the  SEP.  ^ 
multiplex  autopilot.  A  central  library  of  fll^t  trials  recordings 
has  been  established  with  a  cross  referencing  system  which  enables 
any  particular  aircraft  problem  to  be  analysed  using  data  available 
from  all  the  fli^t  test  vehicles. 
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ELICigr  TRIALS  TECHNIQUES 


With  the  instrumentation  system  described  above,  it  is  possible  to 
record  d.  variety  of  adtopilot  parameters  such  as  gyro  signals  or 
computed  data  as  it  appears  at  various  points  in  the  signal  chain. 

In  addition,  the  trials  aircraft  are  fitted  with  pick-offs  enabling 
surface  positions  to  be  recorded. 

During  intensive  autolanding  evaluations  such  as  those  carried 
out  by  BLEU,  the  actual  fli^t  path  of  the  aircraft  in  the 
approach  and  landing  can  be  recorded  by  kinetheodolites .  By 
using  suitable  means  of  cross  referencing  the  data  gathered  on 
the  ground  and  in  the  air,  it  is  possible  to  examine  tlie’  landing 
performance  in  very  great  detail.  This  has  been  done  in  the  past 
and  the  techniques  developed  as  a  result  of  the  earlier  work  will 
be  extended  to  the  intensive  phases  of  the  fli^t  test  work  on 
the  two  new  aircraft. 

However,  an  important  aspect  of  the  developnent  of  any  all-weather 
system  is  its  evaluation  at  a  variety  of  airfields  under  a  variety 
of  weather  conditions.  Obviously,  the  signals  present  within  the 
aircraft  can  still  be  recorded  adequately,  but  there  are  difficulties 
in  obtaining  an  accurate  record  of  the  aircraft's  fli^t  path  at 
airfields  which  are  not  fitted  with  the  necessary  ground  installations. 
Present  studies  are  aimed  at  perfecting  an  inexpensive  and  simple 
technique  to  obtain  photographic  recordings  using  a  commercial  type 
cine  camera.  Apart  fran  its  value  in  recording  the  very  large 
number  of  landings  to  be  made  during  the  development  programme,  such 
a  technique  has  obvious  applications  once  the  new  systems  go  into 
airline  service. 

The  ultimate  clearance  of  the  multiplex  autolanding  autopilot  rests 
on  the  fact  that  it  can  be  shown  to  perform  within  certain  defined 
limits  over  a  certain  ramge  of  wind  and  weather  conditions.  It  is 
expected  that  the  equipment  will  first  of  all  enter  operational  service 
by  being  used  for  landings  in  fair  weather  conditions.  Approximately 
two  year's  operation  of  a  fleet  of  from  25  to  50  aircraft  can  give 
sufficient  reliability  data  to  verify  the  assumptions  as  to  system 
failure  rate  and  the  resultant  chance  of  a  malfunction  during  a 
landing.  During  this  working  up  period,  it  will  also  be  necessary 
to  record  as  many  landings  as  possible.  It  is  hoped  that  a 
combination  of  a  simple  photographic  technique  with  suitable  pilot 
questionnaires  will  enable  this  to  be  done.  Another  possibility  to 
be  explored  is  that  of  using  aircraft  flight  recorders  to  record 
information  relevant  to  an  automatic  lemding.  Apart  from  the  possible 
use  of  crash  recorders  following  an  incident,  some  airlines  are 
considering  the  wider  use  of  flight  recording  as  an  aid  to  monitoring 
the  performance  of  the  aircraft  and  its  systems.  Obviously  any 
tendency  in  this  direction  should  improve  the  chances  of  recording 
the  success  of  an  all-weather  system. 
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Previous  autolanding  trials  have  led  to  the  evolution  of  crew 
techniques  which  are  being  extended  to  the  work  on  the  new 
system.  It  has  always  been  normal  practice  to  carry  an  operating 
crew  of  three,  consisting  of  two  pilots  and  a  fli^t  test 
observer.  During  an  autolanding,  the  latter  monitors  the  overall 
performance  of  the  system  and  calls  out  heists  derived  from  the 
radio  altimeters  as  the  aircraft  goes  through  the  various  phases 
of  the  flare  and  landing.  Normally,  the  aircraft  captain  is 
occupied  in  looking  ahead  emd  is  prepared  to  take  over  manually 
should  this  be  necessary. 

The  autopilots  used  in  this  work  sometimes  employ  quite  high 
control  forces  and  cannot  necessarily  be  overriden  manually  in 
all  axes.  It  has  therefore  always  been  felt  that  some  special 
provision  must  be  made  to  enable  the  pilot  to  override  the  system 
in  an  onergency. 

These  provisions  include  a  new  type  of  autopilot  cut-out  button 
and  a  system  of  manual  override  detectors.  The  cut  out  button 
includes  a  solenoid  mechanism  which  ensures  that  a  relatively 
heavy  force  is  required  to  break  it  out  while  the  autopilot  is 
engaged.  When  the  autopilot  is  disconnected  the  solenoid  relaxes 
and  the  button  requires  a  comparatively  light  force  to  operate  it. 
This  facility  has  two  advantages.  It  discourages  inadvertent 
disengagement  of  the  autopilot  by  unconscious  operation  of  the 
button  and  it  gives  the  pilot  a  tactile  means  of  knowing  whether 
the  autopilot  is  satisfactorily  disconnected  from  the  controls. 

The  manual  override  detectors  are  mounted  in  the  control  runs  at 
a  point  adjacent  to  the  control  column  such  that  they  detect  the 
reaction  when  the  pilot  attempts  to  override  the  automatics  by 
pushing  against  the  servos.  Should  this  push  force  e’xceed 
approximately  40  lbs.  the  autopilot  disconnects.  This  systems 
enables  us  to  combine  the  advantages  of  a  manual  override 
facility  with  an  autopilot  having  the  high  control  authority  and 
hl^  operating  torques  necessary  to  accomplish  accurate  approaches 
in  landings. 

In  most  multiplex  installations,  it  is  the  practice  to  have  a  high 
authority  pitch  trim  system  such  that  the  aircraft  will  be  virtually 
in  trim  should  the  automatics  be  disconnected  during  the  latter 
stages  of  an  approach  and  flare. 

In  optimising  automatic  leuiding  autopilots  a  progressive  approach  is 
adopted.  The  autopilot  is  first  of  all  cleared  for  low  approaches 
so  that  its  low  speed  performance  is  brought  to  the  best  possible 
operation.  After  that  the  automatic  throttle  control  is  optimised 
and  finally  the  operation  is  extended  to  automatic  flare  and 
automatic  landing. 
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A,  Introduction 


Soon  after  the  airlines  had  gained ; operational  experience  with  the  current 
jet  transports,  they  commenced  the^r  own  individual  programs  to  secure 
FAA  approval  for  operation  to  the  ?00-l/2  weather  minimums.  Considerable 
effort  and  expense  has  since  been  expended  by  the  airlines  as  well  as 
the  manufacturers  and  subcontractors  to  accomplish  the  necessary  oper¬ 
ational  and  reliability  improvements  in  the  automatic  pilot  and  flight 
director  systems.  The  familiarization  and  training  portion  of  the  program 
amounted  to  considerable  expenditure  on  the  part  of  the  airlines  also. 
Today,  several  of  the  707/720  operators  have  obtained  FAA  approval  to 
operate  to  the  200-1/2  minimums  at  certain  airports.  These  same  airlines 
have  expressed  their  desire  to  operate  to  substantially  lower  minimums 
with  the  conviction  that  this  can  be  done  in  a  safe,  practical  and 
economically  justifiable  manner. 

The  Boeing  Company  has  been  actively  studying  and  testing  various  items 
of  equipment  for  operating  to  lower  weather  minimums  since  the  707 
program  got  under  way.  The  707  prdtotype,  otherwise  known  as  the  -80, 
was  landed  using  automatic  equipment  in  1958  at  Boeing  Field.  Two 
years  ago,  Boeing  established  a  philosophy  on  which  to  hopefully  build 
a  program  for  airline  operation  to  minimums  well  below  the  200-1/2.  The 
Boeing  philosophy  consists  primarily  of  the  recognition  that  a  successful 
instrument  landing  system  must  be  "pilot-oriented."  Under  both  manual 
and  automatic  control  the  pilot  must  have  positive  assurance  of  proper 
functioning  of  his  equipment  as  well. as  high  quality  flight  path  infor¬ 
mation.  A  sympoaium  was  held  with  the  airlines  in  September  1961  at 
which  tacit  concurrence  with  the  program  for  the  707/720  airplanes  was 
obtained.  The  experience  gained  by  the  airlines  and  the  results  of 
studies  by  Boeing  over  the  ensuing  two  years  have  helped  to  further 
define  the  operational  philosophy  and  airborne  equipment  necessary  to 
operate  safely  .'‘o  the  lowest  practical  and  economically  justifiable 
weather  minimums. 

Boeing  now  believes  that  the  time  has  arrived  for  taking  further 
positive  action  toward  equipping  the  707/720  and  727  for  operation  to 
minimums  below  200-1/2.  Consequently,  incorporation  of  certain  equip¬ 
ment  into  the  production  707/720  and  727  airplanes  is  now  definitely 
planned . 

B.  Boeing  Lower  Minimum  past  and  Current  Research  Effort  -  Conclusions 

The  Boeing  research  effort  has  been  aimed  at  two  objectives:  first, 
to  investigate  the  automatic  and  manual-instrument  landing  equipment 
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requirements  for  the  707  and  727  airplanes,  and  secondly,  to  evaluate 
the  pilot  monitoring  requirements  during  the  approach  and  landing. 

Several  automatic  approach  and  landing  systems  have  been  studied. 

The  Bell  System  and  the  North  American  Autonetics  System,  along  with 
Boeing-developed  glide  slope  extension  and  flare  systems,  were  tested 
In  the  707  prototype  airplane.  Glide  slope  extension  schemes  were 
evaluated  on  both  automatic  pilot  and  flight  director.  Successful 
landings  were  accomplished  with  the;  automatic  pilot  and  also  with  the 
flight  director. 

Various  devices  and  systems  to  aid  the  pilot  In  monitoring  the  approach 
were  also  tested.  Para-vlsual  displays,  glare  shield  mounted  Indicators, 
radio  altimeter  height  displays  and  combinations  of  Information  In  the 
flight  director  were  experimented  with  during  hooded  approaches  and 
landings.  Auto-pllot  and  flight  director  studies  have  been  conducted 
using  analog  computers  and  partial  simulators.  Various  methods  of 
Improving  performance  during  the  last  stages  of  the  approach  are  currently 
under  Investigation.  Heads-up  displays  have  also  been  Investigated  using 
partial  simulators  as  well  as  aircraft. 

These  studies  have  helped  define  present  equipment  capabilities  and 
shortcomings,  and  have  Illuminated  the  automatic  landing  problems 
peculiar  to  large  jet  airplanes.  There  Is  no  doubt  that,  technologically, 
the  automatic  pilot  and  monitoring  requirements  can  be  met  by  many 
different  systems^nander  "laboratory  controlled"  conditions.  The  real 
problem  here  seems  to  be  one  of  developing  a  system  that  has  satisfactory 
and  consistent  performance  and  is  reliable,  and  easy  for  the  airlines  to 
operate  and  maintain.  Further,  It  Is  obvious  that  the  necessary  addl' 
tlonal  airborne  equipment  must  be  compatible  with  the  Innedlate  or  near¬ 
future  airport  environment,  as  well  as  be  able  to  be  retrofitted  easily 
to  the  existing  fleets  of  jet  transports. 

Consequently,  Boeing  has  concluded  that  It  Is  now  possible  to  economically 
equip  the  jet  transport  aircraft  for  lATA  Phase  II  mlnlmums  (approximately 
100-1/4).  It  Is  necessary,  therefore,  to  assess  the  requirements  for 
operating  the  aircraft  safely  to  the  lowest  mlnlmums  where  the  pilot  can 
manually  conduct  or  safely  monitor  the  automatic  landing.  These 
mlnlmums  are  not  defined  at  present  and  can  only  be  determined  by 
simulator  evaluations,  flight  tests  and  service  experience.  Each  air¬ 
plane's  approach  speed  and  handling  characteristics  will  greatly  In¬ 
fluence  the  actual  safe  mlnimims.  Realistic  analysis  of  approach  path 
weather  conditions  Including  the  effects  of  turbulence,  wlndshears  and 
convectlvlty  must  also  be  considered  In  establishing  the  performance 
objectives  of  the  system. 

In  order  to  go  one  step  further  and  obtain  an  idea  of  the  equlpsient  and 
techniques  to  be  used  in  this  program  an  estimate  can  be  made  as  to  the 
lowest  practical  mlnlmums  for  the  pilot  to  either  safely  monitor  an  auto¬ 
matic  touchdown  or  disconnect  and  land  manually.  Based  on  the  flight 
test  In  fog  conditions  at  Areata  and  Newark  In  earlier  aircraft  and  more 
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recent  tests  at  Andrews  AFB  and  Otis  AFB  and  our  own  collective 
experience,  It  Is  believed  that  with  the  airplane  adequately  aligned 
with  the  runway  that  a  visibility  of  approximately  250  yards  would 
be  near  the  practical  lower  limit  considering  10-15  knot  crosswinds, 
gustiness,  etc.  It  Is  also  believed  that  under  these  conditions  the 
pilot  would  need  this  visibility  upon  reaching  approximately  70  feet 
of  altitude  to  adequately  monitor  or  conduct  the  flare  and  landing. 
High  Intensity  approach  and  runway  lighting  are  assumed  to  be 
Installed. 

It  should  be  noted  here  that  the  Bbelng  philosophy  considers  an 
automatic  touchdown  capability  to  pe  a  necessary  part  of  the 
automatic  equipment  for  operations  to  Phase  II  mlnlmums.  A  suc¬ 
cessful  go-around  can  then  be  accomplished  from  any  height  Including 
after  touchdown.  It  Is  hoped  that  the  manually-conducted  approach 
can  satisfy  the  same  ground  rules.  More  studies  on  split  axes 
operation  and  Improved  displays  will  help  to  settle  this  question. 

It  Is  perhaps  appropriate  to  discuss  here  Boeing's  view  with  regard 
to  the  "survlvable  electronics"  philosophy.  Essentially,  this 
philosophy  would  reduce  the  statistical  risk  of  electronic  failure 
to  one  part  In  ten  million  for  the  critical  30  seconds  preceding 
touchdown.  It  Is  essential.  In  considering  this  philosophy,  to 
understand  that  the  statistical  probability  of  arriving  at  the 
station  with  all  electrons  aligned  Is  something  quite  apart  from 
the  quoted  number. 

In  any  event,  one  cannot  quarrel  with  the  objectives  of  up-grading 
system  reliability.  The  two  questions  which  create  the  doubters 
camp  are: 


1.  Are  we  sure  we  know  how  to  achieve  these  reliabilities? 

2.  How  much  Is  It  worth  In  weight,  maintenance  and  Initial 
Investment? 

Achievement  of  system  reliabilities  to  very  high  orders  are  difficult 
even  when  all  elements  are  under  direct  control.  We  at  Boeing  are 
becoming  increasingly  aware  of  the  frequent  occurrence  of  highly 
Improbable  events. 

The  707  electrical  system,  which  consists  of  four  Independent 
generating  systems,  has  a  minute  failure  probability,  yet  all  electrical 
power  has  been  lost  on  a  revenue  flight  from  what  one  might  call  a 
"coomon  event."  This  "common  event"  can  be  caused  by  a  single  mechanic 
or  a  thimble-full  of  aluminum  chips.  Compounding  the  problem  as 
regards  automatic  pllot-'^ontrolled  landing  la  the  fact  the  ground 
Installations  are  not  under  direct  control  of  the  system  designer. 

In  short,  the  anticipation  of  all  cosailatlve-type  failures  Is  a  most 
difficult  technical  task  In  a  multl-eleamnt  Interdependent  system. 
Redundancy  surely  Is  s  valid  attack  provided  that  potentlel 
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cumulative  failures  through  Inter-connectlons  do  not  exist. 

How  much  should  one  pay  to  raise  survlvable  electronics  probability 
above  one  part  In  one  million?  This  certainly  Is  a  function  of  the 
Individual  airline. 

We  at  Boeing  believe  that  a  period  of  operations  to  mlnlmums  below 
the  present  and  above  zero-zero  Is  necessary  for  the  maturing  of  all 
elements  of  the  problem.  However,  we  believe  the  Installed  (lATA) 

Phase  II  equipment  should  be  capable  of  consistent  touchdown  under 
automatic  control.  We  also  believe  that  the  energy  management  aspect 
of  automatic  landing  systems  (flight  path  and  speed  control)  holds 
promise  of  reducing  the  landing  accident  rate  for  both  IFR  and  VFR 
operations.  We  think  we  can  achieve  (lATA)  Phase  II  operation  with¬ 
out  the  penalities  attendant  to  statistical  failure-proofing.  Further, 
considerations  of  dispatch  reliability,  DOC's  and  the  unpredictable 
"common  event"  make  us  skeptical  of  having  the  ability  at  this  point 
In  time  to  achieve  the  desired  level  of  safety  necessary  for  routine 
zero-zero  operations. 

The  International  controversy  on  "All  Weather"  or  "Lower  Minima" 
solutions  poses  a  first-order  dllenma  for  an  airframe  manufacturer. 

The  reasons  are  rather  fundamental.  The  reception  of  the  "solution" 
will  vary  with  the  airline's  route  structure,  economic  outlook, 
accumulated  experience  and  the  strongly  held  opinions  to  be  found  In 
most  operations  departments.  This  puts  the  manufacturer  In  the  position 
of  being  damned  If  he  does  and  damned  If  he  doesn't  on  many  of  the 
equipment  decisions  available  to  him.  Those  who  say  "give  any  airline 
the  equipment  that  It  wants"  are  overlooking  the  fierce  competitive 
pressures  on  basic  airplane  costs  whlcn  can  give  the  manufacturer  the 
choice  of  over-prlclng  or  under-equipping  In  approaching  a  potential 
customer.  This  exaggeration  Is  used  merely  to  Illustrate  the  thorny 
nature  of  the  "All  Weather"  subject  which  fact  Is  amply  supported  by 
the  very  size  and  scope  of  this  conference. 

Let  us  now  address  ourselves  to  the  actions  which  seem  Indicated  at 
this  point  In  time.  The  Boeing  Company  research  program  to  date  has 
been  briefly  described.  Also  available  to  us  are  the  results  of  the 
extensive  work  performed  in  the  United  Kingdom,  France  and  in  the  USA. 

A  weighting  of  these  results  discloses  some  areas  of  general  agree¬ 
ment  and  areas  of  controversy.  From  major  controversy  such  as 
"survivability"  to  minor  controversy  such  as  surrounds  automatic 
throttles  there  are  a  host  of  equipments  and  configurations  which 
are  heatedly  debated.  However,  let  us  look  at  what  we  think  a 
majority  would  agree  upon: 

1.  The  Improved  ILS  will  be  used. 

2.  Some  form  of  glide  slope  extension  Is  ndcessary. 

3.  Automatic  pilot  failures  below  100'  oust  surely  be  passive. 
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4.  Ground  proxlolty  indication  is  needed. 

5.  Automatic  pilot  performance  must  aasure  beam  centerline 
bracketing  under  reasonable  crosswind  gradients  and 
gustiness. 

6.  Windshield  rain  removal  systems  must  be  optimised. 

Automatic  speed  control  by  throttle  will  be  added  to  this  list  if 
the  majority  of  the  airlines  agree  that  this  is  necessary  or  very 
desirable . 

707/720  Lower  Weather  Minimum  Program 

The  707/720  airplanes  being  delivered  in  1963  have  been  equipped  with 
several  automatic  pilot  and  flight  instrument  improvements  such  as: 

1.  Navigation  instrumenc  warning  system 

2.  Optimised  flight  director  gain  of  Bendlx  System  in  approach 
?.  Improved  automatic  pilot  disengage  warning 

4.  Improved  automatic  pilot  amplifier  computer 

5.  Provisions  for  future  addition  of  augmented  glide  slope 
and  flare  computer,  as  plug  in  modules,  within  the  auto¬ 
matic  pilot  amplifier-computer. 

The  following  itesm  have  been  added-  to  the  program  and  -wtll  be 
incorporated  in  the  airplanes  on  a  timely  basis. 

1.  Accentuated  warning  of  localiser  and  glide  slope  failure 
by  additional  light  and  audible  warning. 

2.  Improved  automatic  pilot  with  flare  computer. 

3.  Full  tisie  yaw  damper  with  integrated  hydraulic  actuator 
and  yaw  handover  protection. 

4.  Autooiatic  approach  monitor-roll  and  pitch  axes. 

5.  Low-range  radar  altimeter. 

6.  Improved  windshield  rain  removal  system. 

7.  An  optional  automatic  speed  control  system. 

Design  of  the  installations  will  be  such  that  a  minimum  amount  of 
airplane  modification  to  retrofit  existing  models  will  be  necessary. 

Should  aerodynamic  differences  necessitate  variations  in  equipment 
we  would  endeavor  to  achieve  such  changes  either  by  "plug-in"  modules 
or  by  changes  in  the  airplane  installation.  Every  attempt  will  be 
made  to  maintain  the  identical  basic  equipment. 
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Some  additional  explanation  to  help  In  the  understanding  of  the 
choice  of  program  might  be  useful: 

1.  Improved  Automatic  Pilot  Approach  Capability 

Accurate  alignment  on  the  glide  and  localizer  paths  and 
stability  of  the  airplane  during  gusts,  varying  crosswinds, 
beam  bends,  etc.  Is  extremely  Important  during  the  latter 
phases  of  an  approach.  This  will  be  achieved  by  sensing 
necessary  parameters  to  damp  and  average  the  ILS  Information, 
yet  providing  primary  guidance  by  ILS.  Some  additional 
performance  capability  will  be  required  In  the  localizer 
control  to  give  faster  recovery  to  beam  centerline  under 
varying  crosswind  conditions.  Certain  promising  techniques 
are  being  evaluated  and  the  best  practicable  method  will  be 
Implemented . 

2.  Flare  Computer 

An  Integral  part  of  the  engineering  design  of  the  current 
automatic  pilot  Is  the  facility  for  addition  of  a  flare 
computer  within  the  automatic  pilot  amplifier  computer. 

This  design  criteria  was  established  during  the  September 
1961  symposium.  The  automatic  pilot  portion  of  this 
feature  will  be  Implemented  and  may  be  considered  to  be 
an  extension  of  the  augmented  glide  slope  but  using 
Information  from  a  radar  altimeter  Instead  of  the  air  data 
sensor  used  In  the  automatic  pilot. 

3.  Full  Time  Yaw  Damper 

The  current  yaw  damper  Is  the  rudder  channel  of  the  automatic 
pilot  system  shlwh  drives  an  electric  servo.  All  automatic 
pilot  Inputs  are  felt  at  the  rudder  pedals.  The  new  system 
as  planned  Is  generally  as  outlined  during  the  September 
1961  symposium  utilizing  a  new  series  Integrated  hydraulic 
actuator  which  will  cause  no  rudder  pedal  motion  or  forces. 
The  rudder  channel  of  the  automatic  pilot  system  will  be  used 
as  the  electronic  package.  The  system  will  be  similar  to 
that  being  used  on  the  727  where  the  yaw  Input  will  be 
mechanically  limited  to  five  (5)  degrees  and  no  outside 
Influences  such  as  cable  friction  or  pilot  Input  can  reduce 
the  yaw  damper  effectiveness.  Plus  or  minus  five  (5) 
degrees  of  yaw  damping  will  always  be  available  from  any 
trim  or  pilot  controlled  position. 

4.  Automatic  Pilot  Approach  Monitor 

All  707/720  airplanes  have  facilities  for  Installing  an 
automatic  pilot  comparison  unit.  The  new  approach  isonitor 
will  replace  the  comparison  unit,  will  work  under  tighter 
tolerances,  be  more  reliable,  be  limited  in  operation  to 
approach  isodes  only  and  would  utilize  existing  space  and 
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wiring  provisions  wherever  possible.  Assuming  no 
relaxation  of  current  regulations,  such  a  unit  would  be 
required  for  operation  to  low  mlnlmums. 

5.  Low  Range  Radar  Altimeter 

This  will  be  an  additional  system  Installation  In  the  707/ 

720  alrplaies. 

6.  Improved  Windshield  Rain  Removal 

For  optimum  visual  ground  contact  some  Improvement  Is 
desirable  In  keeping  the  windshield  clear  under  rain 
conditions.  The  recently  developed  Boeing  rain  removal 
system  Is  simple  and  effective,  consisting  of  a  solenoid 
operated  repellent  fluid  jet  system  for  operation  In  con¬ 
junction  with  the  existing  windshield  wipers.  Two  presurlzed 
containers  with  manual  selection  are  connected  to  a  solenoid 
operated  valve  controlled  from  the  cockpit.  Operation  of 
the  cockpit  control  switch  causes  a  jet  of  water  repellent 
solution  to  be  ejected  onto  both  the  Captain's  and  First 
Officer's  windshield.  Subsequent  wiping  by  the  wipers  on 
the  wet  windshield  produces  a  highly  water  repellent  surface 
such  that  vl:>lblllty  In  rain  Is  vastly  Improved. 

7.  Automatic  Pilot  Throttle  Control 


Since  this  will  be  an  additional  new  system  which  Is  not 
directly  dependent  on  other  systems  and  since  the  desirability 
for  Its  use  may  be  best  determined  by  Individual  operators, 
the  automatic  throttle  control  system  Is  planned  to  be  Installed 
as  a  customer  option.  Similarity  to,  and  commonness  with  the 
Installation  on  the  727  will  be  maintained  wherever  possible. 

The  system  will  be  fully  engineered  and  evaluated  concurrently 
with  the  other  Items. 

As  has  been  outlined  the  addition  of  the  chosoi  systems  occasions  very 
little  change  to  the  electronic  complement  of  the  airplane.  Further, 
the  chosoi  systems  are.  Insofar  as  practicable,  derivatives  of  the 
current  electronic  Installation.  Accordingly,  we  anticipate  that 
retrofit  to  all  existing  model  707/720  airplanes  can  be  achieved 
without  a  considerable  amount  of  rework  or  "time  out  of  service." 

727  Lower  Weather  Minimum  Program 

All  airplanes  of  the  Model  727  contracted  for  after  January  1,  1963 
will  contain  provisions  for  the  following  lower  weather  mlnlmums 
equipment. 
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1.  Dual  Fitch  Channel  monitor  and  auto  flare 

2.  Lateral  control  monitor 

3.  Instrument  comparators  (heading  and  attitude) 

4.  Radar  Altimeter 

5.  Third  attitude  Indicator 

6.  Automatic  speed  control  system  (optional) 

Of  these  Items,  the  customer  may  order  the  Installation  '^f  equipment 
at  his  option.  These  features,  coupled  with  provisions  which  have 
been  Installed  In  the  basic  airplane  from  Its  conception,  will.  In 
our  judgement,  allow  operation  to  mlnlmums  of  100  feet  and  below. 
Boeing's  reasons  for  offering  these  features  can  be  explained  as 
follows: 


1.  Dual  Pitch  Channel 

The  dual  pitch  channel  Is  being  Installed  to  Insure  a 
passive  type  failure  In  the  event  of  a  hardover  signal.  A 
more  simplified  monitor  could  accomplish  this;  however,  the 
dual  pitch  channel  offers  other  significant  advantages:  (a) 
Accuracy  of  failure  detection  Is  Improved  (b)  The  dual 
elevator  control  system  has  been  designed  for  primary  control 
from  either  or  both  elevators,  providing  operational  capability 
and  safety  (c)  There  Is  a  logistics  benefit  arlstlng  from 
monitors  and  pitch  channels  being  Identical,  (d)  A  Hydrau¬ 
lic  failure  can  be  sensed  and  compensated  for  In  addition 
to  the  electronic  hardover  failure  (e)  The  dual  channel 
has  the  additional  advantage  that  either  automatic  pilot 
channel  may  be  operated  Independently  for  all  functions 
other  than  lower  mlnlmums. 

2.  liSteral  Control  System  Monitor 

The  lateral  control  monitor  Is  being  Installed  to  prevent 
an  Inadvertent  hardover  aileron  action.  While  this  may  not 
be  a  requirement  for  low  approach  certification,  a  simplified 
monitor  will  be  Installed  as  a  conservative  measure. 

3 .  Instrument  Comparison  Warning  System  (Attitude  and  Heading) 

Visual  comparison  of  left  hand  and  right  hand  Instruments  Is 
currently  the  accepted  method  of  detecting  those  failures 
which  are  not  displayed  by  warning  flags.  Early  detection 
of  failure  becomes  more  Important  when  operating  to  lower 
weather  mlnlmums.  A  centralized  Instrument  warning  system, 
based  on  comparison  techniques.  Is  already  flying  on  many 
Boeing  airplanes. 

4.  Radar  Altimeter 

The  radar  altimeter  Is  necessary  since  It  Is  the  only  known 
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instrument  that  will  give  us  the  required  accuracy  In  altitude 
reading  above  the  terrain  which  Is  essential  In  this  type  of 
landing.  This  will  be  an  Important  factor  In  giving  the  pilot 
the  necessary  confidence  to  allow  the  airplane  to  proceed 
to  the  minimum  authorized  height  In  conditions  of  poor  visibility. 
It  Is  being  Installed  mainly  as  a  flight  Instrument,  but  It  will 
also  provide  other  Important  functions  during  the  approach. 

5 .  Third  Attitude  Indicator 

This  Instrument  Is  being  Installed  to  provide  back-up  for  the 
attitude  comparator  system.  Instruments  such  as  the  airspeed 
and  rate  of  turn  could  satisfy  the  same  purpose;  however,  It 
Is  believed  that  a  simple  and  direct  reading  attitude  Indicator 
can  provide  the  desired  Information  In  a  more  useful  form. 

6.  Automatic  Speed  Control 

The  optional  automatic  speed  control  Installation  will  be 
simplified  to  the  greatest  possible  extent.  Although  automatic 
speed  control  Is  being  Installed  to  Increase  the  precision  of 
the  approach  to  lower  mlnimums  Its  use  will  not  be  restricted 
to  this  mode. 

The  following  basic  features  of  the  727  airplane  supplement  the  above- 
mentioned  Items: 

1.  Lower  landing  speeds. 

2.  Excellent  speed-thrust  stability. 

3.  Improved  aerodynamic  speed  brakes. 

4.  Improved  reverse  thrust  and  wheel  brakes. 

5.  Improved  windshield  rain  clearing. 

6.  Full  time  dual  yaw  damper. 

7.  Automatic  pilot  designed  for  tighter  beam  following  under  adverse 
weather  conditions  during  the  approach. 

8.  Automatic  pilot  with  extended  glide  slope  built-in. 

9.  Automatic  pilot  designed  for  operational  flexibility  with 
features  such  as  split  axes  and  all  angle  VOR  and  ILS  capture 
capabilities. 

10.  Automatic  pilot  with  built-in  self-test  for  ease  of  maintenance. 

C.  Svaanarv 

Flights  on  the  three  727  test  airplanes  have  thus  far  Indicated  that 
the  performance  of  Its  automatic  pilot  with  the  extended  glide  slope 
Is  equal  to  or  better  than  expectations.  The  early  recognition  of  the 
eventual  707/727  operation  below  current  mlnimums  has  made  It  necessary 
to  plan  the  basic  707  and  727  automatic  pilots  for  maximum  flexibility 
and  growth  capability.  This  planning  Includes  provisioning  for 
operations  beyond  Phase  II  so  that  transition  to  Phase  III  can  take 
place  In  an  orderly  and  economic  manner. 
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INTRODUCTION 


U,  S,  commercial  aviation  has  now  arrived  at  a  major  milestone;  the 
decision  to  begin  an  evolutionary  approach  to  provide  Category  II  Operation 
with  the  present  high  performance  jet  aircraft.  Most  of  the  airlines  have 
already  outlined  a  program  they  will  follow  in  achieving  this  goal;  many  of 
the  airlines  have  already  taken  the  first  step  in  this  evolutionary  approach 
to  the  Category  II  Operation,  It  is  the  intent  of  this  paper  to  discuss  some 
of  the  aspects  that  must  be  considered  in  determining  the  evolutionary  steps 
to  be  taken.  It  is  a  further  intent  of  this  paper  to  discuss  the  results 
obtained  in  the  Lear  Siegler,  Inc.  (LSi)/SUD  Aviation  All-Weather  Landing 
Program  now  being  conducted  in  Toulouse,  France,  in  the  Caravelle,  and  to 
show  how  these  results  affected  the  final  decisions  in  arriving  at  the 
operational  configuration  now  being  implemented  in  the  SUD  Caravelle s.  It 
is  hoped  that  the  dissemination  of  information  about  the  practical  experience 
obtained  on  this  program,  together  with  the  reasons  for  certain  decisions, 
can  assist  the  airlines  in  formulating  their  own  plans  for  step-by-step 
implementation  of  their  equipment  to  attain  the  final  goal  of  Category  II 
Operation. 

SUMMARY 


In  determining  the  aircraft  implementation  necessary  for  Category  II 
Operation,  there  are  three  requirements  which  must  be  considered: 
economics,  safety,  and  performance.  However,  before  making  a  valid 
decision  based  on  these  requirements,  it  is  necessary  for  the  airline  to 
define  what  it  hopes  to  obtain  from  Category  II  Operation.  There  are  three 
general  approaches  that  can  be  taken  to  arrive  at  the  final  goal,  and  each 
of  these  approaches  appears  to  require  a  different  equipment  implementation: 

. .  .Operation  to  100-foot  ceiling  and  one-quari.'Jr  mile  visibility 
. . .  Operation  to  some  minimum  RVR  (e.  g, ,  400  meters) 

, .  .Interim  step  to  complete  zero/ zero  operation 

The  first  concept  for  Category  II  Operation  is  to  select  the  suggested 
100-foot  ceiling  and  one-quarter  mile  visibility  as  the  final  goal,  and 
implement  the  aircraft  accordingly  without  further  considerations  at  this 
time.  There  appears  to  be  a  general  feeling  that  minor  modifications  of 
existing  equipments  can  provide  the  required  performance  in  meeting  this 
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goal.  However,  if  a  more  realistic  look  at  the  Category  II  minimum  is  taken, 
it  will  be  realized  that  operation  to  100  feet  of  altitude  of  necessity  will  be  a 
look-and-see  proposition;  and,  as  such,  an  RVR  (runway  visual  range)  is  a 
more  realistic  means  of  specifying  minimums. 

In  actual  practice,  it  is  doubtful  if  the  existence  of  a  100-foot  ceiling 
can  actually  be  measured  or  predicted  accurately  for  the  precise  time  and 
location  over  the  ground  where  the  pilot  will  be  reaching  a  100-foot  altitude 
on  his  final  approach.  Usually  these  lower  ceilings  are  ragged  and/or 
obscured,  and  vary  considerably  over  relatively  small  areas.  In  addition, 
the  methods  of  measuring  such  ceilings  do  not  provide  extreme  accuracy. 

This  variation  in  ceiling  consistency  and  measurement  accuracy  has  been 
pointed  out  by  the  results  obtained  at  Chicago's  O'Hare  Airport.  Simulta¬ 
neous  readings  have  recently  been  made  on  two  separate  runways  with 
independent  measuring  devices;  very  appreciable  differences  in  reporting 
altitude  were  obtained. 

Even  without  these  factors,  a  pilot  making  an  approach  to  100  feet 
and  one -quarter  mile  would  normally  undertake  a  "look-and-see"  attitude. 

This  means  that  if  in  reality  a  pilot  is  able  to  pick  up  the  approach  lights  on 
an  intermittent  basis,  and  if  he  is  right  on  course,  he  will  in  all  probability 
elect  to  continue  the  approach  to  a  lov(er  altitude  and  will  not  abort  as  long 
as  his  visibility  remains  adequate  for  a  visual  landing  (approximately  400 
meters).'  Thus,  practical  considerations  indicate  that  operation  to  100  feet 
and  one -quarter  mile  for  Category  II  Operation  is  not  a  realistic  concept, 
and  the  RVR  method  of  specifying  operational  minimums  for  Category  II 
Operation  is  more  desirable. 

Experience  gained  on  the  LSi/  SUD  program  has  indicated  that 
optimum  performance  is  required  to  operate  with  an  RVR  of  400  meters, 
if  safety  and  the  frequency  of  missed  approaches  are  taken  into  consideration. 
This  performance  cannot  be  provided  by  simple  modifications  of  existing 
equipment. 

The  third  concept  in  Category  II  Operation  is  to  take  the  British 
approach  and  implement  only  that  part  of  the  full  Category  III  system  neces¬ 
sary  to  achieve  Category  II.  However,  it  is  doubtful  if  the  economics  can 
justify  such  an  approach  for  U.  S.  carriers.  Furthermore,  it  is  considered 
impossible  to  finalize  an  adequate  automatic  landing  system  until  considerable 
actual  operational  usage  is  obtained  on  such  an  automatic  landing  system 
under  Category  II  minimums.  An  incident  that  occurred  during  the  LSi/SUD 
program  clearly  demonstrates  the  need  for  a  great  deal  of  operational  usage 
before  committing  a  system  to  Category  III  zero/zero  operation. 


3 


DETAILS 


Let  us  look  at  the  equipment  that  will  probably  be  required  and/or 
desired  to  operate  to  Category  II  minimums.  In  the  first  case,  where  a 
100-foot  ceiling  and  one-quarter  mile  visibility  is  used  as  the  final  goal, 
the  following  implementation  would  probably  be  required  in  the  aircraft; 

. .  .Radio  (radar)  altimeter 

. . .  Path  monitoring  system 

. .  .Improved  lateral  path  performance 

. .  .Improved  longitudinal  path  performance 

. .  .Hard-over  failure  protection 

. . .  Optimization  of  the  basic  autopilot 

. . .  Go-around  mode 

Radio  Altimeter:  It  is  doubtful  if  any  of  the  certification 
agencies  in  the  U.  S.  or  European  governments  will  certify  an 
aircraft  in  regularly  scheduled  passenger  service  to  operate 
to  a  100-foot  ceiling  without  the  benefit  of  a  radio  altimeter. 

From  the  pilot's  standpoint,  it  is  also  highly  desirable  to  have 
a  radio  altimeter  on  board,  sipce  it  does  give  him  that  additional 
confidence  that  is  required  to  kssure  him  that  he  iB~in  effect  at 
the  proper  altitude. 

Path  Monitoring  System;  It  appears  quite  mandatory  that 
some  form  of  a  path 'monitoring  system  and  pilot  warning  must 
be  provided  for  operation  down  to  100  feet  and  one-quarter  mile 
visibility.  The  limits  to  be  monitored  must  be  provided  in  the 
form  of  a  "tunnel"  in  space,  with  the  desired  flight  path  in  the 
center  of  this  tunnel.  The  aircraft  must  enter  this  tunnel 
through  a  window  at  approximately  the  present  minimums  of 
300  feet  of  altitude,  and  must  stay  in  this  tunnel  until  the  new 
minimums  of  100  feet  are  reached.  If  at  any  time  the  aircraft 
goes  outside  this  tunnel,  the  path  monitoring  system  must  warn 
the  pilot  so  that  he  can  make  a  go-around  without  further  delay. 
Since  the  pilot's  ability  to  correct  the  path  deviation  prior  to 
touchdown  decreases  with  altitude,  this  tunnel  must  be  conical 
or  truncated,  rather  than  cylindrical  or  rectangular.  This 
means  that  the  path  monitoring  system  must  monitor  angular 
deviation  from  the  path  rather  than  pure  displacement. 

Improved  Lateral  Path  Performance;  It  appears  that  none 
of  the  present-day  automatic  approach  couplers  or  flight-director 
computers  can  provide  the  necessary  performance  for  lateral 
direction  to  the  100-foot  altitude  without  improvements. 
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Improved  Longitudinal  Path  Performance;  It  is  obvious  that 
none  of  the  present-day  couplers  or  flight-director  computers 
have  the  capability  of  providing  the  required  performance  to  the 
100-foot  altitude  point.  This  means  that  more  precise  flight 
path  tracking  must  be  provided.  With  any  of  the  present  coupling 
concepts,  some  form  of  glide  path  gain  change  to  compensate  for 
the  convergence  of  the  angular  beam  must  be  made,  and  some 
form  of  so-called  glide  path  extension  (memory)  must  be  provided 
to  arrive  safely  at  the  100-foot  level. 

Hard-Over  Failure  Protection;  For  safety,  the  autopilot/ 
airplane  combination  must  be  capable  of  being  certified  to  opera¬ 
tion  to  100  feet  of  altitude  under  the  present  methods  of  certifica¬ 
tion  for  minimum  altitudes  with  autopilot  engaged.  Some  of  the 
present  autopilot /airplane  combinations  are  already  certified  to 
altitudes  of  100  feet  or  less,  and  have  no  further  problem  here. 
However,  other  airplane /autopilot  combinations  require  some 
modifications  or  changes  in  order  to  allow  certification  for 
autopilot  operation  to  100  feet  of  altitude. 

Optimization  of  the  Basic  Autopilot  for  the  Approach  Config¬ 
uration;  All  of  the  autopilots  in  operation  today  are  calibrated 
to  perform  at  optimum  at  some  compromise  speed  condition. ,  In 
other  words,  an  autopilot  must  be  able  to  perform  adequately  at 
the  high  cruise  condition  and  also  in  the  approach  condition. 
However,  up  to  this  time  the  emphasis  has  been  more  on  the 
cruise  condition,  with  a  compromise  in  performance  being  accep¬ 
ted  in  the  approach  configuration.  In  order  to  operate  to  Category 
II,  some  optimization  of  the  basic  autopilot  will  have  to  be  pro¬ 
vided  for  the  approach  configuration. 

Throttle  Control:  Automatic  throttle  control  can  be  a  contro¬ 
versial  subject  when  it  is  considered  as  a  requirement  for  Cate¬ 
gory  II  operation;  but  from  a  pilot's  standpoint  it  is  certainly  de¬ 
sirable,  because  it  relieved  him  of  this  function  and  allows  him  to 
devote  more  of  his  time  and  effort  to  monitoring  the  performance 
of  the  aircraft  on  the  flight  path.  From  this  viewpoint  alone  it 
should  probably  be  considered  as  part  of  the  implementation 
requirements. 

Go- Around  Mode;  As  with  throttle  control,  the  requirement 
for  a  go-around  mode  for  Category  II  Operation  to  100  feet  can  be 
controversial,  but  it  is  felt  that  the  desirability  of  a  go-around 
mode  (either  manual  or  automatic)  is  well  established. 
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Now  consider  the  hardware  implementation  for  the  second  concept 
to  Category  II  Operation:  that  is,  with  the  only  limitation  being  an  RVR 
of  400  meters.  Some  of  the  implementation  requirements  will  remain  the 
same  as  for  the  first  concept  of  Category  II  Operation;  other  requirements 
will  also  be  imposed.  It  is  felt  that  the  following  items  are  requirements, 
or  are  highly  desirable: 

. ,  .Radio  (radar)  altimeter 

.  .  .  Path  monitoring  system 

.  .  .  Optimum  lateral  path  perfbrmance 

. . .  Optimum  longitudinal  path  performance 

.  .  .Hard-over  failure  protection 

.  .  .  Complete  optimization  of  the  basic  autopilot 

.  .  .  Throttle  control 

. . .  Go-around  mode 

. .  .  Automatic  flare 

. . .  De-crab 

.  .  . Pilot  display 

Radio  Altimeter:  This  is  required  for  the  same  reason 
given  for  operation  to  100  feet|and  one -quarter  mile. 

Path  Monitoring  System:  This  must  be  provided  for  the 
reason  given  above,  but  in  addition  it  must  have  the  further 
capability  of  being  able  to  monitor  to  altitudes  lower  than  the 
100  feet.  It  appears  desirable  for  this  monitoring  system  to 
remain  operative  until  the  flare  is  initiated. 

Optimum  Lateral  Path  Performance:  In  this  concept  of 
Category  II  Operation,  the  pilot  will  often  be  descending  to 
altitudes  which  will  bring  him  over  the  end  of  the  runway  and 
possibly  to  touchdown.  Thus  it  is  imperative  that  the  best 
lateral  path  control  be  provided,  even  though  it  may  be 
extending  the  present  state-of-the-art. 

Optimum  Longitudinal  Path  Performance:  As  with  the 
lateral  path,  control  must  be  maintained  to  flare,  and  it  is 
felt  that  the  longitudinal  path  of  the  aircraft  must  be  controlled 
with  the  highest  accuracy  obtainable  even  if  it  requires  extend¬ 
ing  the  present  state-of-the-art.  With  the  present  glide  path 
beams  this  appears  to  offer  a  major  challenge,  even  though  the 
accuracy  requirements  are  not  as  severe  as  for  the  lateral 
path:  particularly  because  with  the  present-day  runways  the 
longitudinal  touchdown  point  does  not  have  to  be  nearly  as 
precise  as  the  lateral  touchdown  point. 
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Hard- Over  Failure  Protection;  In  this  concept  of 
Category  II  Operation,  the  autopilot  must  have  the  capability 
of  remaining  engaged  to  altitudes  well  below  100  feet  with 
safety.  It  is  essential  that  the  system  contain  adequate  safety 
to  protect  against  a  hard-over  failure  at  any  altitude  down  to 
touchdown. 

Complete  Optimization  of  the  Basic  Autopilot  for  the 
Approach  Configuration;  It  is  thought  mandatory  that  in  order 
to  obtain  the  optimum  lateral  and  longitudinal  path  performance 
for  the  final  phases  of  the  approach,  it  is  essential  that  the 
basic  autopilot  itself  be  optimized  for  the  approach  configura¬ 
tion  including  new  concepts  in  automatic  control. 

Throttle  Control:  It  is  felt  that  automatic  throttle  control 
operation  is  much  more  of  a  requirement  for  operation  to 
400  meters  RVR.  This  is  especially  true  because  most  auto¬ 
matic  flare  systems  require  retardation  of  the  throttles  at 
the  initiation  of  flare.  This  feature  cannot  be  provided 
adequately  as  a  manual  input  from  the  pilot. 

Go- Around  Mode;  The  go-around  mode,  either, manual 
or  automatic,  is  highly  desirable  and  may  be  a  certification 
requirement  to  operate  to  altitudes  below  100  feet. 

Automatic  Flare;  It  is  felt  that  automatic  flare  must  be 
provided  to  operate  safely  to  an  RVR  of  400  meters.  With  this 
concept  for  Category  II  Operation,  the  pilot  will  be  descending 
to  altitudes  at  which  his  flare  should  already  have  commenced. 
To  assure  the  desired  safety  it  is  felt  that  the  certification 
agencies  in  the  U.  S.  and  European  governments  will  require 
an  automatic  flare  mode  for  certification. 

De-Crab;  Some  means  of  de-crabbing  the  aircraft  must 
be  provided,  either  automatically  or  as  a  manual  maneuver 
by  providing  the  pilot  with  the  proper  presentation. 

Pilot  Display;  Operating  with  this  concept,  it  is  felt  highly 
desirable  that  some  panel  instrument  should  supply  the  pilot 
with  the  same  information  that  is  being  pro'^'ided  to  the  autopilot, 
so  that  he  can  adequately  monitor  the  performance  being 
obtained.  This  information  can  either  be  provided  by  a  flight 
director  computer  modified  to  provide  the  sanie  output  as  the 
autopilot  computer,  or  by  an  independent  output  provided  to  the 
pilot  display  from  the  autopilot  computer. 
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For  the  third  concept  of  Category  II  Operation,  which  is  an  interim 
step  to  Category  III  Operation,  all  of  the  hardware  that  is  necessary  for 
operating  to  an  RVR  of  400  meters  is  needed.  In  addition,  as  an  economic 
consideration,  the  system  must  utilize  the  same  basic  components  and 
techniques  which  will  be  necessary  to  provide  complete  safety  in  the  final 
Category  III,  or  full  zero/zero  operation.  This  means  that  the  system  has 
to  be  designed  with  the  final  redundancy  requirements  in  mind  so  that  the 
system  provided  for  Category  II  under  this  concept  will  furnish  the  basic 
nucleus  for  the  final  redundant  system  for  the  full  zero/zero  or  Category 
III  Operation. 

In  reviewing  the  first  two  concepts  of  Category  EL  Operation  in  rela¬ 
tion  to  the  hardware  implementation  requirements,  the  following  comments 
based  on  the  experience  obtained  on  the  LSi/SUD  development  program  are 
offered: 


Radio  Altimeter:  This  is  a  firm  requirement  in  both  concepts. 
In  the  first  concept  (100  feet  and  one-quarter  mile)  a  radio  altimeter 
of  less  accuracy  could  be  utilized.  However,  unless  an  airline 
already  had  a  radio  altimeter  of  this  type,  there  would  be  no  appre¬ 
ciable  initial  economic  advantage  in  going  to  a  radio  altimeter  of 
lesser  accuracy. 

Path  Monitoring  System:  This  is  also  a  firm  requirement  in 
both  concepts.  If  the  aircraft  is  not  within  a  specified  "window" 
at  some  minimum  altitude,  then  the  approach  to  100  feet  or  400 
meters  RVR  should  not  be  continued.  The  only  difference  is  that 
in  the  first  case  the  monitoring  system  operates  to  100  feet,  while 
in  the  second  it  must  operate  to  the  flare  altitude.  However,  this 
should  not  require  a  change  in  implementation. 

Improved  Lateral  and  Longitudinal  Path  Performance:  In 
considering  the  first  concept  of  Category  II  Operation,  i.e., 
operating  to  100  feet  and  one -quarter  mile  visibility,  the  natural 
tendency  is  to  modify  the  existing  equipments  with  minimal 
changes.  With  the  improved  directional  localizer  beams  and  with 
various  schemes  of  glide  path  extension,  it  appears  feasible  to 
modify  the  existing  equipment  for  operation  down  to  100  feet  and 
one-quarter  of  a  mile.  However,  with  the  experience  obtained 
during  the  LSi/SUD  program,  it  appears  that  the  wind  shear,  or 
wind  gradient,  can  be  much  more  severe  than  thought  at  present 
and  thus  there  will  probably  be  many  more  missed  approaches 
than  are  now  experienced  with  the  present  equipment  operating 
to  the  present  minimums.  This  can  have  an  adverse  effect  on 
the  whole  Category  II  Operation  in  that  if  missed  approaches 
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become  quite  common,  the  pilots  will  not  have  the  confidence  in 
the  equipment  necessary  to  encourage  them  even  to  attempt 
approaches  under  the  100  feet  and  one -quarter  mile  conditions. 

The  generally-discussed  wind  gradient  for  the  final  approach  con¬ 
figuration  is  four  knots  of  change  per  100  feet  of  altitude*  and  it 
appears  that  any  of  the  present  equipment  with  minor  modifica¬ 
tions  is  capable  of  coping  with  wind  gradients  of  this  magnitude. 

The  experience  obtained  during  the  LSi/SUD  program  indi¬ 
cates  that  this  gradient  in  practice  is.  much  more  severe  than 
generally  accepted,  and  it  also  appears  that  this  gradient  becomes 
more  severe  as  the  altitude  decreases,  due  to  the  effects  of  the 
ground  on  the  air  mass.  Fore  and  aft  wind  shears  of  30  knots  per 
100  feet  of  altitude,  lasting  for  periods  of  eight  seconds,  have 
actually  been  recorded  by  rather  complete  instrumentation  on  at 
least  three  of  the  automatic  landings  made  in  Toulouse.  The  ter¬ 
rain  at  Toulouse  is  relatively  level,  and  would  not  be  considered 
conducive  to  causing  such  wind  shears.  The  weather  conditions 
at  the  time  these  occurrences  were  recorded  did  not  appear  to  be 
abnormal. 

The  wind  shear,  which  Was  recorded  as  occurring  during  the 
flare,  caused  the  aircraft  to  strike  the  runway  with  no  apparent 
change  in  flight  path  angle  a/id  caused  an  extremely  hard  landing 
(somewhat  cushioned  by  the  ground  effect).  If  this  same  fore  and 
aft  wind  shear  had  been  obtained  during  a  manual  landing,  it  is 
doubtful  if  the  pilot  would  have  been  capable  of  counteracting  the 
effect  sufficiently  to  make  a  smooth  landing.  It  is  felt  that  some 
of  the  normal  manual  landings,  which  resulted  in  excessively  hard 
runway  contact  and  in  which  the  pilot  had  difficulty  analyzing  after¬ 
wards  where  he  erred,  may  have  been  the  result  of  just  such  wind 
shears. 

Figure  1  is  a  flight  recording  (taken  in  a  Caravelle)  of  a  normal 
automatic  landing.  Figure  2  is  a  flight  recording  of  the  same  type 
of  automatic  landing  in  the  Caravelle  in  the  presence  of  the  severe 
wind  shear  described  before.  It  should  be  noted,  in  referring  to 
the  two  figures,  that  in  the  case  of  the  normal  landing,  the  air 
speed  decreases  about  three  knots  from  initiation  of  flare  \intil 
touchdown.  However,  in  the  case  of  the  severe  wind  shear,  it  is 
apparent  that  the  air  speed  decreased  far  in  excess  of  the  three 
knots;  if  extrapolated  off  the  paper,  a  decrease  approaching  20 
knots  could  be  shown.  Also,  in  reference  to  the  two  figures,  note 
that  the  aircraft  elevator  position  normally  increases  about  three 
degrees  during  the  flare,  but  in  the  case  of  the  wind  shear  the 
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elevator  position  increased  over  six  degrees.  Even  with  this,  the 
wind  shear  effects  were  so  severe  that  the  automatic  landing  sys¬ 
tem  was  capable  only  of  maintaining  the  rate  of  descent  existing 
at  the  time  of  initiation  of  flare.  It  is  realized  that  this  severe 
wind  gradient  occurred  during  the  flare;  when  considering  ceilings 
of  100  feet,  this  would  be  in  the  manual  realm.  However,  longi¬ 
tudinal  wind  gradients  do  occur  far  in  excess  of  the  four  knots  per 
100  feet,  even  during  the  so-called  glide  path  extension  phase. 
Figure  3  indicates  the  flight  path  deviation  occurring  with  and 
without  positive  glide  path  control  from  250  feet  to  initiation  of 
flare  in  the  presence  of  wind  gradients.  Because  of  this,  it  was 
felt  highly  desirable  to  maintain  positive  glide  path  control  until 
initiation  of  flare.  The  glide  path  beam  signal  characteristics  are 
not  as  good  as  with  the  localizer  beam,  and  the  beam  convergence 
is  much  more  severe.  Thus  it  is  impossible  to  maintain  positive 
glide  path  control  with  adequate  gain  margin  to  the  initiation  of 
flare  by  any  modification  of  the  existing  coupler  systems. 

On  the  LSi/SUD  program,  it  was  found  that  an  entirely  new 
concept  of  glide  path  control  had  to  be  evolved  in  order  to  main¬ 
tain  positive  path  control  until  the  initiation  of  flare.  No  system 
which  uses  a  memory  type  of  glide  path  extension  scheme  can 
provide  the  accuracy  desired  for  a  low-minimum  program  in  the 
presence  of  severe  wind  gradients  which  appear  to  be  more  pre¬ 
valent  than  might  be  expected. 

Experience  on  the  LSi/SUD  program  has  also  indicated  that 
wind  gradients  approaching  the  same  magnitude  appear  in  the 
lateral  case.  Crab  angles  of  15  degrees  have  been  experienced 
at  150  to  200  feet  of  altitude  with  the  touchdown  occurring  with  a 
zero  crab  angle.  At  the  approach  speeds  of  the  Caravelle,  this 
is  equivalent  to  a  cross-wind  gradient  of  16  knots  per  100  feet, 
which  is  far  in  excess  of  four  knots  per  100  feet.  None  of  the 
present-day  lateral  couplers  can  cope  with  such  a  gradient,  even 
when  optimized  for  a  directional  localizer  beam.  Early  analytical 
tests  in  the  LSi/SUD  program  pointed  out  the  fact  that  in  the  pres¬ 
ence  of  wind  shear  a  new  technique  in  lateral  coupler  control  had 
to  be  developed,  or  excessive  missed  approaches  would  result 
for  any  type  of  lower  minimum  program.  The  lateral  coupler 
developed  in  the  LSi/SUD  program  in  addition  to  being  optimized 
for  the  directional  localizer  beam,  eliminates  the  heading  signal 
and  features  hew  design  concepts.,  This  provides  a  coupler  that 
will  cope  with  most  of  the  probable  wind  gradients.  In  tests  with 
the  L-102  autopilot  coupler  now  standard  in  the  Caravelle,  a  12- 
knot  step  input  of  wind  change  laterally  resulted  in  a  165-foot 
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lateral  deviation  before  corrective  action  caused  a  return  to  the 
beam  center.  This  maximum  lateral  deviation  occurred  18  to 
20  seconds  after  application  of  the  step  input.  The  same  12- 
knot  step  input  in  the  new  lateral  coupler  in  the  LSi/SUD  program 
produced  only  a  13-foot  deviation,  which  occurred  within  eight 
seconds  after  initiation  of  the  input,  at  which  time  corrective 
action  was  initiated  to  return  to  beam  center  without  overshoot. 

If  this  wind  shear  had  been  ot>tained  at  200  feet  of  altitude,  the 
existing  L-102  coupler  would!  have  landed  the  airplane  off  the 
runway.  Any  heading-stabililzed  coupler  will  have  the  same 
difficulty  in  correcting  for  these  lateral  wind  gradients. 

The  wind  gradients  actually  experienced  in  the  LSi/SUD 
program  disagree  with  the  information  presented  in  RTCA  SC-79, 
which  is  the  source  of  the  presently  accepted  four  knots  per  100 
feet.  However,  the  larger  figures  obtained  on  the  LSi/SUD  pro¬ 
gram  are  not  the  result  of  an  isolated  occurrence;  also,  they  are 
well  documented,  and  as  such  should  be  considered  valid.  For 
this  reason,  it  is  felt  that  a  mere  modification  of  existing  couplers 
is  completely  inadequate  to  meet  the  requirements  of  lower  mini- 
mums  for  either  the  concept  of  100  feet  and  one  quarter  of  a  mile 
or  for  the  concept  of  an  RVR  of  400  meters.  We  cannot  afford  to 
have  more  missed  approaches  at  these  lower  minimums;  if  we  do, 
the  whole  lower  minimums  program  will  be  defeated.  In  view  of 
the  fact  that  it  is  rather  difficult,  or  impossible,  to  simulate  a 
severe  wind  gradient  in  actual  flight  tests,  the  certification 
agencies  should  require  a  demonstration  (on  an  analog  computer) 
of  the  capability  of  both  the  lateral  and  longitudinal  computers 
in  correcting  for  severe  wind  gradients.  On  an  analog  computer 
it  is  relatively  easy  to  simulate  any  desired  wind  gradient. 

Hard-Over  Failure  Protection;  In  the  case  of  the  100 -foot 
ceiling,  hard-over  failure  protection  would  have  to  be  demonstrated 
only  down  to  a  100-foot  altitude.  However,  as  indicated  previously, 
if  the  ceiling  were  actually  somewhat  lower  than  100  feet  at  the 
time  the  pilot  reached  his  100-foot  altitude,  due  to  the  approximate 
one -second  time  lag  of  the  pilot  and  the  fact  that  another  one  and 
one-half  seconds  are  consumed  after  the  pilot  initiates  go-around 
before  the  aircraft  starts  changing  its  flight  path,  it  would  be 
quite  easy  to  have  the  autopilot  engaged  inadvertently  down  to  an 
altitude  of  75  feet  or  lower.  .  For  this  reason  it  is  felt  that  hard- 
over  protection  must  be  obtained  in  some  other  manner  than  the 
present  torque -limiting  procedures  which  cannot  possibly  result 
in  a  certified  altitude  much  below  100  feet.  On  the  LSi/SUD 
'ogram,  the  initial  certification  will  be  attempted  for  100  feet 
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and  one-quarter  mile.  This  is  because  the  L-IOZ  autopilot/ 
Caravelle  combination  can  be  certified  down  to  an  altitude  of  90 
to  100  feet  in  its  present  configuration. 

As  indicated,  it  is  felt  that  this  is  an  inadequate  means 
of  protection  from  a  practical  operational  standpoint.  For 
this  reason  an  active  development  program  is  under  way  which 
is  a  continuation  of  the  LSi/SUO  program  to  develop  an  auto¬ 
pilot  fail- soft  monitor  (Safe  Limit  Protection  Circuits).  It  is 
felt  that  the  path  monitoring  system  is  adequate  in  providing 
the  necessary  monitoring  for  a  soft  (or  passive)  type  of  failure. 
Thus,  if  an  autopilot  can  be  made  to  fail  soft  under  all  conditions, 
within  very  restrictive  changes  in  aircraft  attitude,  it  will  be 
possible  to  operate  the  autopilot  safely  to  touchdown  as  long  as 
the  pilot  can  visually  monitor  the  flare  and  landing  phase  of  the 
approach.  The  LSi/SUD  fail-soft  concept  has  already  been 
developed  and  the  first  flying  breadboard  has  been  fabricated 
and  flight  tested  with  highly  encouraging  results. 

Redundant  or  monitoring  systems  are  probably  adequate 
in  providing  this  same  fail-soft  (passive)  feature;  however,  it 
was  felt  that  the  technique  derveloped  in  the  LSi/SUD  program 
was  less  complex  and  was  simpler  to  implement.  ~Space  provi¬ 
sions  have  already  been  allocated  for  this  fail- soft  feature  in 
the  production  LSi/SUD  All-Weather  Landing  System.  It  is 
hoped  that  flight  test  results  of  this  fail- soft  feature  can  be 
introduced  into  the  production  hardware  before  the  first 
operational  use  of  this  system  by  an  airline,  which  will  pro¬ 
bably  be  in  the  autumn  of  1964. 

Optimization  of  the  Basic  Pilot;  In  order  to  obtain  the 
optimum  lateral  and  longitudinal  path  performance  necessary 
to  cope  with  wind  gradients,  it  was  discovered  early  in  the  LSi/ 
SUD  All-Weather  Landing  Program  that  it  was  essential  to 
optimize  the  autopilot  for  the  approach  configuration.  The  first 
approach  was  to  optimize  only  the  gains  of  the  existing  autopilot. 
However,  it  was  determined  that  a  rather  large  improvement  in 
both  lateral  and  longitudinal  path  performance  could  be  obtained 
by  providing  signal  shaping  optimization  of  the  attitude,  rate, 
and  servo  feedback  signals.  In  trying  to  implement  this  in  the 
standard  L-102  autopilot,  it  was  found  that  a  very  complex 
switching  method  was  required  at  the  time  the  automatic  landing 
system  was  engaged.  From  a  complexity  and  a  reliability 
standpoint  this  was  certainly  very  undesirable.  The  decision 
was  thus  made  to  provide  the  optimum  autopilot  within  the 
lateral  and  longitudinal  computers  of  the  All-Weather  Landing 
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System.  This  minimized  switching  considerably  and  did  not 
increase  the  complexity  of  the  overall  system.  Thus  with  the 
present  system,  when  the  all-weather  landing  computers  are 
engaged,  all  of  the  major  autopilot  signals  are  switched  out  of 
the  existing  autopilot  and  into  the  All-Weather  Landing  System. 
The  only  parts  of  the  autopilot  that  are  used  during  the  final 
approach  are  the  servos  and  the  servo  amplifiers.  Another 
consideration  in  this  decision  was  the  extent  of  change  that 
would  be  required  in  the  existing  autopilot.  With  this  concept 
of  providing  the  optimized  autopilot  within  the  automatic 
landing  computer  boxes,  the  changes  to  the  existing  autopilot 
are  quite  negligible  and  can  be  accomplished  by  a  technician 
on  a  retrofit  basis  within  an  hour  or  two. 

Throttle  Control;  In  a  system  which  will  be  used  only  down 
to  100  feet  of  altitude,  automatic  throttle  is  certainly  not  a  re¬ 
quirement  (although  highly  desirable).  However,  in  a  system  that 
will  be  used  to  some  altitudes  less  than  100  feet,  which  could 
include  the  altitude  required  for  the  flare  initiation,  the  automatic 
throttle  control  becomes  much  more  of  a  requirement.  It  is 
impossible  to  execute  a  satisfactory  flare  without  retardation  of 
the  throttles.  This  would  not  be  a  desirable  manual  maneuver  to 
have  accomplished  at  50  feet  of  altitude,  since  it  would  require 
some  pilot  monitoring  which  is  better  spent  in  monitoring  other 
aspects  of  the  approach.  As  a  result,  it  is  felt  that  automatic 
throttle  control  will  probably  be  made  a  requirement  by  the 
certification  authorities  for  operations  at  altitudes  below  100 
feet.  But  as  indicated  before,  from  a  practical  operational 
consideration  the  100-foot  minimum  would  actually  be  exceeded 
more  often  than  not  when  the  altitudes  are  in  effect  at  the  100- 
foot  levels.  Thus  it  is  felt  that  automatic  throttle  control  should 
be  part  of  any  lower  minimum  system. 

Go- Around  Mode;  During  the  early  part  of  the  LSi/SUD 
program,  the  go-around  mode  was  considered,  but  it  was 
decided  at  that  time  that  it  was  a  luxury  feature,  and  as  such 
would  not  be  essential  to  the  developed  system.  However,  it 
was  agreed  that  before  completion  of  the  flight  test  program  the 
go-around  mode  would  be  implemented  and  evaluated  in  actual 
flight  tests.  This  flight  evaluation  has  now  been  completed  and 
the  results  of  the  flight  tests  of  the  automatic  go-around  mode 
were  so  satisfactory  and  proved  to  be  so  desirable  from  the 
pilot's  standpoint  that  the  decision  was  made  to  implement  the 
automatic  go-around  mode  in  the  production  system.  Thus  the 
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production  system  will  include  the  automatic  go-around  feature 
with  a  separate  output  for  presentation  in  a  pilot  display  in  case 
the  manual  go-around  mode  should  be  desired. 

The  concept  employed  to  implement  automatic  go-around 
in  the  LSi/SUD  program  was  that  of  utilizing  existing  signals  so 
that  there  would  be  no  requirement  for  switch-over  to  a  signal 
that  was  not  already  being  presented  to  the  pilot.  In  the  LSi/SUD 
All-Weather  Landing  System,  the  primary  longitudinal  control 
is  instantaneous  vertical  velocity;  hence  the  decision  was  made  to 
introduce  a  vertical  velocity  command  signal  into  the  existing 
system.  For  additional  reliability,  this  command  signal  is  intro¬ 
duced  via  isolated  inputs  through  the  individual  microswitches  of 
each  throttle.  A  rate  of  climb  that  can  be  maintained  is  commanded, 
in  the  case  of  the  Caravelle,  for  a  single  engine  with  full  power. 
Present  thinking  is  that  this  go-around  mode  will  be  used  only  for 
the  first  few  seconds  after  the  decision  has  been  made  to  abort  the 
approach.  As  soon  as  the  climb  has  been  firmly  established,  the 
pilot  can  then  switch  over  to  some  other  mode  of  operation. 

Actual  in-flight  recordings  of  the  automatic  flare  and  go- 
ar  ound  functions  have  shown  that  the  aircraft  flight  path  continues 
at  the  same  rate  of  descent  for  about  one  and  one -half  seconds 
after  the  flare  or  go-around  mode  has  been  initiated.  At  a  rate 
of  sink  of  10  feet  per  second,  this  means  that  the  aircraft  has 
proceeded  15  feet  below  the  altitude  at  which  initiation  was  effected. 
If  it  is  now  considered  that  the  human  pilot  has  a  one  -  to  two  - 
second  time  lag  in  making  the  decision  to  initiate  the  go-around,  it 
is  evident  that  it  is  possible  for  the  airplane  to  descent  30  or  40 
feet  below  the  minimum  altitude  before  establishing  a  positive 
vertical  velocity.  For  this  reason  it  is  felt  that  the  go-around 
mode  should  be  a  requirement  even  for  operation  to  100-foot  mini- 
mums. 

Automatic  Flare:  From  the  standpoint  of  safety  considerations, 
boththe  certification  authorities  and  the  operational  users  will 
require  an  automatic  flare  system  for  operation  to  altitudes  be¬ 
low  100  feet.  With  present  jet  aircraft,  the  flare  must  be  initiated 
before  reaching  50  feet  of  altitude  to  prevent  the  necessity  for  an 
abrupt  maneuver  during  the  final  phases  of  the  flare  and  landing. 
From  a  safety  standpoint,  the  automatic  flare  feature  is  quite  essen¬ 
tial  for  operation  to  an  RVR  of  400  meters,  where  the  corresponding 
altitude  may  be  as  low  as  50  feet.  Under  these  conditions  the  pilot 
will  be  making  every  effort  to  establish  visual  contact  and  might 
not  realize  that  he  was  passing  through  the  minimum  flare  altitude. 
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The  automatic  flare  feature  is  probably  quite  desirable  for 
operation  to  the  100-foot  altitude  because,  as  discussed  pre¬ 
viously,  in  practical  operations  the  pilot  •will  in  effect  exceed 
this  100-foot  minimum  limitation  quite  frequently  due  to  ground 
measurement  inaccuracies  and  variable  ceiling  characteristics. 
There  is  probably  a  very  good  chance  that  the  certifications 
agencies  will  not  certify  a  lower  minimum  system  to  operate 
to  either  100  feet  or  400  meters  RVR  without  an  automatic 
flare  feature. 

De-Crab;  The  de-crab  feature  is  certainly  not  a  considera¬ 
tion  for  operating  to  100  feet  of  altitude.  Also,  it  is  not  a  con¬ 
sideration  for  operating  to  any  altitude  where  it  is  thought  that 
a  manual  landing  would  be  effected.  However,  in  any  system 
where  an  automatic  landing  will  be  mad?',  the  de-crab  feature 
certainly  warrants  consideration.  The  question  of  whether  the 
de-crab  should  be  performed  automatically  or  whether  the  infor¬ 
mation  should  be  presented  to  the  pilot  cannot  be  answered 
readily.  Implementation  of  the  automatic  de-crab  is  relatively 
straight-forward  and  does  not  provide  a  major  technical  chal¬ 
lenge.  But  from  the  reliability  and  safety  aspects,  the  auto¬ 
matic  de-crab  feature  is  somewhat  questionable.  The  de-crab 
function  must  occur  at  a  very  low  altitude:  in  the  case  of  the 
Caravelle  this  is  about  12  feet.  The  de-crab  signal  must  neces¬ 
sarily  be  an  entirely  new  signal  that  is  switched  into  the  system 
at  that  particular  time.  In  the  event  of  a  passive  malfunction  of 
the  4e-crab  signal,  it  is  questionable  whether  the  pilot  would 
recognize  the  fact  that  the  de-crab  had  not  taken  place  in  time  to 
provide  a  completely  adequate  manual  de-crab.  The  application 
of  a  de-crab  signal  of  the  opposite  phase  could  in  turn  be  even 
more  catastrophic.  In  addition,  compass  system  tolerances  and 
the  requirement  for  the  pilot  to  set-in  the  proper  runway  heading 
pose  additional  problems. 

At  the  present  time  a  final  decision  has  not  been  made  on 
the  automatic  de-crab  for  the  LSi/SUD  All-Weather  L<anding 
System.  The  decision  has  been  made  to  provide  the  production 
system  with  both  an  automatic  function  and  a  pilot  indication,  so 
that  either  automatic  or  manual  de-crab  may  be  implemented. 

If  some  users  should  decide  that  they  would  like  to  have  the  auto¬ 
matic  de-crab  function,  it  could  be  adapted  to  their  systems;  if 
they  do  not  wish  to  have  it,  they  have  only  to  supply  a  jumper 
across  two  terminal  points  to  exclude  this  feature  during  the 
flare  phase.  In  any  case,  an  indication  will  be  provided  for 
manual  de-crab. 
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Pilot  Display;  For  any  lower  minimum  system,  in  addi¬ 
tion  to  the  path  warning  monitor,  it  is  felt  that  the  pilot  should 
have  available  to  him  on  some  instrument  the  same  output 
that  is  being  introduced  into  the  autopilot  for  automatic  control. 

This  provides  the  pilot  with  a  little  more  confidence  in  his  role 
of  monitor  during  the  final  phases  of  the  approach.  For  this 
reason  the  Caravelles  which  will  have  the  All-Weather  Landing 
System  will  be  provided  with  the  necessary  switching  to  allow 
the  pilot  to  monitor  the  output  of  the  automatic  landing  coupler 
on  flight  director  needles.  In  addition,  the  pilot  will  be  given 
the  capability  of  using  the  output  of  the  landing  computers  on  the 
flight  director  needles  to  accomplish  a  manual  approach.  Actual 
flight  tests  and  numerous  simulator  tests  have  shown  that  the 
pilot  can  make  a  much  better  manual  approach  using  the  output 
of  the  new-concept  longitudinal  and  lateral  computers  than  he  can 
with  any  of  the  standard  coupler  concepts  presently  in  use. 

In  summary,  it  appears  on  the  basis  of  practical  considerations 
that  Category  II  Operation  will  be  an  RVR  type  of  operation;  whether  a 
ceiling  limit  of  100  feet  is  established  or  not,  the  pilot  will  in  all  probab¬ 
ility  be  operating  as  he  would  with  the  establishment  of  a  400-meter  RVR. 
Thus  it  appears  that  the  implementation  of  a  system  for  Category  II  Oper¬ 
ation  should  include  most  of  the  features  for  automatic  touchdown.  In 
view  of  the  severity  of  wind  gradients  encountered  under  actual  conditions, 
it  is  absolutely  necessary  that  the  autopilot  and  the  couplers  be  designed 
for  optimum  performance  by  taking  a  step  forward  from  the  present  state- 
of-the-art.  If  this  is  not  done,  the  frequency  of  missed  approaches  may 
cause  the  defeat  of  the  whole  lower  weather  minimum  program. 

Thus  one  might  say  that  in  view  of  the  foregoing,  it  might  be 
better  to  operate  to  Category  II  with  the  British  concept,  which  considers 
Category  II  as  merely  the  stepping  stone  to  Category  III,  zero/zero  opera¬ 
tion.  Two  factors  weigh  against  this  concept:  the  first  is  the  economics  - 
it  is  doubtful  if  any  of  the  U.  S.  operators  can  justify  the  implementation 
of  the  British  triplex  system  on  this  basis.  The  second  factor  against 
such  a  concept  is  the  fact  that  there  are  too  many  unknowns  in  the  opera¬ 
tional  use  of  an  automatic  landing  system.  It  should  be  pointed  out  here 
that  more  than  400  landings  were  accomplished  during  the  LSi/SUD  pro¬ 
gram  before  this  severe  wind  gradient,  which  caused  the  aircraft  to  con¬ 
tact  the  runway  at  the  same  rate  of  descent  that  was  established  at  the 
initiation  of  flare,  was  encountered.  Because  of  the  inability  of  the  auto¬ 
matic  flare  system  as  developed  to  cope  with  this  magnitude  of  wind 
gradient,  the  longitudinal  computer  for  the  SUOCaravelle  was  modified 
to  provide  a  satisfactory  flare  even  under  these  conditions.  It  was  pos¬ 
sible  on  the  analog  computer  to  directly  duplicate  the  results  obtained 
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in  the  actual  landing  by  applying  a  wind  gradient  of  30  knots  per  100 
feet  during  the  last  eight  seconds  of  flare.  Figure  4  is  an  analog  com¬ 
puter  run  of  a  normal  automatic  landing.  Figure  5  illustrates  the 
same  condition  with  the  simulated  wind  gradient.  Starting  from  this 
point,  it  was  possible  by  modifying  the  longitudinal  computer  and 
throttle  control  systems  to  cope  with  such  a  wind  gradient  and  effect  a 
satisfactory  flare  on  the  analog  computer.  Figure  6  is  an  illustration 
of  the  operation  of  the  system,  as  modified,  in  the  presence  of  wind 
shear.  This  implementation  has  now  been  incorporated  in  the  actual 
production  hardware  in  the  Caravelle,  but  it  may  be  some  time  before 
the  actual  conditions  are  again  encountered  to  determine  if  the  analog 
computer  solution  is  valid  under  actual  conditions. 

This  one  incident  did  not  occur  until  after  400  landings  had  been 
made  during  the  flight  test  program.  What  other  incidents  of  completely 
different  character  may  occur  when  the  automatic  landing  system  gets 
into  operational  usage  in  many  aircraft?  Is  it  desirable,  then,  to  commit 
oneself  to  a  zero/zero  landing  system  before  such  a  system  has  been 
tried  for  several  years  under  actual  operational  conditions?  Only  after 
extensive  operation  could  one  feel  reasonably  sure  that  all  of  the  con¬ 
siderations  affecting  safety  had  been  taken  care  of  in  the  final  system 
design.  This  means  then  that  the  concept  for  Category  U  Operation 
should  be  to  provide  the  best  possible  system  with  fully  automatic 
landing  capabilities.  The  operational  usage  of  this  system  in  Category 
II  Operation,  while  the  pilot  is  still  able  to  visually  monitor  the  flare 
and  landing,  will  provide  a  safe  method  of  determining  the  suitability 
of  an  automatic  landing  system.  After  a  system  has  been  evolved  in 
this  manner,  the  decision  can  be  made  whether  or  not  it  is  economically 
sound  to  go  to  the  redundancy  required  for  zerb/zero  operation.  It  may 
be  that  some  new  electronic  technical  breakthrough  by  that  time  will  be 
able  to  provide  the  pilot  with  suitable  visual  information  during  zero/ zero 
operation  and  thus  eliminate  the  requirement  for  going  to  a  multiplex 
system  for  safety  reasons. 

We  feel  that  the  system  evolved  on  the  LSi/SUD  program  has  made 
the  necessary  step  forward  in  the  state-of-the-art  to  allow  safe  and  re¬ 
peatable  operation  in  the  presence  of  all  the  known  factors  at  this  tikne. 
We  further  feel  that  certification  of  this  system  for  use  to  touchdown 
under  Category  II  conditions  will  result  in  major  benefit  to  the  industry 
in  determining  the  requirements  for  a  Category  III  system,  and  at  the 
same  time  will  provide  maximum  safety  for  operation  in  Category  II 
weather.  Do  we  dare  take  a  compromise  in  performance  and/or  safety 
for  Category  II  Operation? 
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CONCLUSION 


The  LSi/SUD  All-Weather  Landing  Program  represents  a  pro¬ 
gressive  evolution  based  on  experience,  and  recognizes  the  desire  of 
the  human  pilot  to  remain  master  of  the  craft  at  any  time  during  flight. 
Therefore  it  has  been  felt  mandatory  that  the  pilot  must  be  provided 
with  as  efficient  a  system  as  possible:  an  automatic  flight  control  sys¬ 
tem  capable  of  executing  automatic  landings  reliably  and  safely,  and  an 
information  system  permitting  the  pilot  to  monitor  the  operation  of  the 
automatic  system  and  to  take  over  at  any  time  either  to  execute  a  go- 
around  or  manual  landing.  The  system  will  permit  attainment  of  lower 
operating  minimums  soon  after  its  introduction.  From  the  beginning 
of  design,  space  and  wiring  provisions  were  made  for  later  implemen¬ 
tation  of  safe-limit  protection  circuits  to  provide  a  fail-passive  charact¬ 
eristic  of  the  autopilot  with  minor  perturbation  of  the  flight  path,  and  to 
simultaneously  alert  the  pilot.  Autopilot  operation  under  visual  monitor¬ 
ing  will  thus  be  possible  down  to  the  touchdown  and  during  ground  run. 

It  is  felt  that  the  present  autopilots  and  couplers  in  jet  aircraft 
can  be  improved  for  Category  I  operations,  but  do  not  have  the  perfor¬ 
mance  capability  to  provide  reliable,  safe  operation  under  Category  II 
conditions  without  major  modifications.  If  it  is  desired  to  keep  aircraft 
modifications  to  a  minimum  for  economic  and  operational  reasons,  it 
is  simpler  and  more  economical  to  design  the  optimum  autopilot  para¬ 
meters  for  final  approach  into  the  all-weather  landing  computers,  thus 
simplifying  the  retrofit  program  as  far  as  the  autopilot  is  concerned. 
Positive  glide  path  control  to  flare  is  deemed  essential;  the  normal 
glide  path  extension  schemes  are  not  found  to  be  adequate  in  providing 
the  necessary  longitudinal  touchdown  accuracy  in  the  presence  of  fore 
and  aft  wind  shears.  These  wind  shears  in  practice  were  found  to  be 
much  more  severe  than  generally  acknowledged.  Radio  altimeters  are 
believed  essential  for  operational  safety  both  for  Category  II  and  Cate¬ 
gory  III  operations;  automatic  flare  may  be  a  requirement  by  the  certi¬ 
fication  agencies  for  Category  II  operation  since  operational  procedure 
for  Category  II  will  be  a  look-and-see  operation  and  the  100-foot  ceiling 
restriction  will  in  reality  be  ignored  for  the  more  practical  400-meter 
RVR  limitation.  The  automatic  throttle  control  system,  while  not 
critical,  is  a  highly  desirable  function  from  the  pilot's  viewpoint  and  is 
probably  a  requirement  with  automatic  flare;  the  automatic  go-around 
mode  is  likewise  desirable.  The  de-crab  problem  must  be  resolved 
for  Category  III  operations;  the  automatic  de-crab  system  which  has 
been  developed  performs  well,  but  due  to  the  need  to  set  in  a  correct 
runway  heading  and  related  tolerances  of  the  compass  systems,  as 
well  as  other  operational  problems,  there  is  not  yet  a  complete  con¬ 
viction  that  automatic  de-crab  is  the  way  to  go.  Automatic  roll-out 
is  not  considered  essential  with  visually  monitored  automatic  landings. 
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However,  as  a  Phase  III  requirement  a  system  has  been  tested.  At 
the  present  time  it  is  implemented  with  the  beam  error  and  the  run¬ 
way  heading  into  the  rudder;  highly  satisfactory  control  is  maintained 
down  to  60  knots  even  in  the  presence  of  cross-winds. 

With  improved  means  of  path  control  and  adequate  failure 
warning  and  situation  display  systems,  it  is  felt  that  the  pilot  is  a 
very  satisfactory  monitor,  and  that  no  autopilot  redundancy  is  required 
other  than  that  for  the  pilot's  information  channel.  The  Category  II 
system  si  deemed  adequate  for  Category  111  operations  without  additional 
autopilot  redundancy,  provided  that  the  "fail-passive"  performance  of 
the  autopilot  is  assured  and  the  pilot  is  given  adequate  failure  warning 
and  a  separate  approach  display  system. 
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Figure  1.  Airborne  Recorder  Charts  of  a  Typical  Automatic  Landing  -  Caravelie 
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Figure  2.  Airborne  Recording  Charts  of  an  Automatic  Landing  with  Severe  Tail  Wind  Gust 
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Figtire  3.  Caravelle  Automatic  Lianding  with  Horizontal  Wind  Shear 
15  Knots/ 100  Feet  Starting  at  250  Feet 
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Vlfur*  5  Simulation  CaravoUe  Automatic  Landing  Figure  6>  Caravelle  Automatic  Landing  Tail  Wind 
Tall  Wind  Guat  with  no  Compeneation  Gust  with  Compensation 


